rmrlx RAT host recon data exfil to C2 212.34.141.103:4521

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•1

Detects outbound TCP traffic containing system reconnaissance data, such as OS information, computer name, and location, being sent to a known C2 server address. The rule monitors for specific content patterns indicative of an infected host checking in or exfiltrating host configuration details.