Koktevrat Android RAT TCP tunnel proxy_open command observed

Arnold Chan@slaz

•updated Sep 17, 2026•0•0•1

Detects specific command strings ('proxy_open', 'proxy_data', 'proxy_close') associated with the Koktevrat Android RAT's tunneling functionality. The rule monitors outbound TCP traffic to identify the initiation, data transfer, and termination phases of a proxy connection, leveraging Suricata flowbits to track the state of the C2 tunnel.