Koktevrat DGA WebSocket C2 checkin to icu/cfd domain

Arnold Chan@slaz

•updated Sep 17, 2026•0•0•2

This rule detects potential command and control (C2) activity associated with the Koktevrat malware, specifically looking for WebSocket handshake requests (HTTP GET with 'Upgrade' header) to domain names that follow a generated pattern (8-27 alphanumeric characters ending in .icu or .cfd).