DNS/network connections to ted/curlRAT C2 domains

Arnold Chan@slaz

•updated Sep 5, 2026•2•0•2

This rule detects network communication (via DNS queries, web logs, or device network events) with a list of known malicious domains associated with Command and Control (C2) activity.