KREMLIN Browser Extension WebSocket C2 Connection to luizestrelhashapr.online

Arnold Chan@slaz

•updated 24 days ago•0•0•7

Detects network activity associated with the KREMLIN browser extension communicating with a known command and control domain (luizestrelhashapr.online). The rule monitors DNS queries, TLS SNI connections, and HTTP WebSocket upgrade requests to identify potential C2 communication.