Turla ComRAT Network Communication Detection

SigmaHQ Detections@sigmaHQ

•updated Jun 12, 2025•0•22

Detects network communication patterns associated with the Turla ComRAT malware, specifically looking for HTTP/HTTPS requests containing '/index/index.php?h=' in the URI. This pattern is indicative of ComRAT's command and control (C2) communication.