XMRig C2 heartbeat check-in via /ping?h= URI pattern on port 10000

Ibrahim Saud@tektrix

•updated 23 days ago•0•0•2

Detects network activity associated with the SilkParasite botnet. The rule identifies inbound/outbound HTTP heartbeat check-ins using a specific URI pattern (/ping?h=) and direct TCP connections to a known malicious C2 IP address.