Possible Gorilla RAT C2 registration and TCP tunnel beacon traffic

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•2

Detects outbound TCP traffic from the internal network to external destinations that match characteristics of Gorilla RAT registration beacons. This includes established sessions with small packet sizes (<64 bytes) and frequent, repeated attempts as defined by the threshold.