StyleSmuggler C2 WebSocket-over-TLS to windwsecurity.run / 99.84.67.186
Detects outbound network traffic associated with StyleSmuggler C2 infrastructure. The rule identifies established TLS connections to a known malicious IP address (99.84.67.186) and monitors for WebSocket-over-TLS traffic using the suspicious SNI 'windwsecurity.run'.
Suricata
