JWR PhaaS WebSocket C2 handshake path (webSocket/QT/.../khkjsahfjkwhakjlsdwddddd

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

This rule detects a specific HTTP request pattern associated with the JWR-family Phishing-as-a-Service (PhaaS) platform. The detection looks for a WebSocket handshake initiation (GET request with specific URI segments 'webSocket/QT/' and a known hardcoded string) and an 'Upgrade' header, which are indicative of a command-and-control (C2) channel establishment.