NeedyMantis C2 WebSocket Upgrade with Hardcoded Firefox/21.0 User-Agent
Detects outbound network traffic associated with the NeedyMantis actor, specifically identifying a hardcoded outdated Firefox/21.0 User-Agent in HTTP requests attempting to upgrade to a WebSocket connection, as well as direct TLS communication with the identified C2 domain corp.tripswithengine.com.
Suricata
