Network connections to known SpiceRAT C2 IPs on ports 80/443

Ankit Mehta@Secvyn

•updated 22 days ago•0•0•2

Detects outbound network connections to known command-and-control IP addresses associated with the SpiceRAT malware family. The rule monitors DeviceNetworkEvents for successful connections or connection attempts over ports 80 and 443.