DNS lookup for RatHat-style admin[.]/adminapi[.] C2 panel on cheap TLD

Ibrahim Saud@tektrix

•updated 7 days ago•0•0•0

Detects DNS queries for RatHat C2 panels using characteristic naming patterns and specific malicious domains, as well as outbound network connections to known RatHat C2 IP infrastructure.