TLS handshake to ipinfo.io from host mid-cycle in Sauron Loader C2 beaconing

Ibrahim Saud@tektrix

•updated Sep 26, 2026•0•0•0

This rule detects two-stage suspicious network activity: first, a POST request to a known Sauron Loader C2 endpoint ('/api/t'), and second, a subsequent TLS connection to 'ipinfo.io' used for geolocation. The correlation is achieved using flowbits to track the infection lifecycle.