TAG-195 WebSocket C2 agent_register Host Profiling JSON Schema Match

Duo Tech@duotech

•updated Jul 24, 2026•0•0•3

Detects specific WebSocket JSON-formatted C2 agent registration and profiling traffic associated with the TAG-195/TinyEgg campaign. The rules look for specific registration markers (agent_register, request_register) and host profiling data (hostname, username, OS, domain, isAdmin status) characteristic of this threat actor's C2 communication.