FRP Client Reverse Tunnel Handshake to External C2 (RatHat ADB Exposure)

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•0

Detects network handshake patterns associated with the Fast Reverse Proxy (FRP) client, specifically identifying outbound traffic containing identifiers used in common FRP reverse tunnel configurations. This behavior is indicative of unauthorized remote access tools or tunneling software establishing a connection to an external command-and-control server.