RUSTYSHADE GitHub API C2 via command/results/heartbeat artifact files

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•3

Detects network traffic to GitHub API endpoints that matches patterns indicative of RUSTYSHADE malware communicating with a private repository for command and control. The rule specifically looks for access to repository content paths related to commands, results, heartbeats, screenshots, or information files, coupled with the inclusion of an Authorization token in the HTTP header.