Network connections to known SpiceRAT C2 IPs and hostnames

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•2

Detects network communication to known SpiceRAT Command and Control (C2) IP addresses and DNS queries for known SpiceRAT-related domains. The rule identifies potential compromise by flagging outbound traffic or DNS resolutions associated with SpiceRAT infrastructure.