MALWARE Gh0st RAT Impersonation Domain TLS (Campaign Trio/Chorus)
This rule detects TLS connections to domains associated with Gh0st RAT impersonation campaigns, specifically 'Campaign Trio' and 'Campaign Chorus'. It looks for specific strings ('i4tools', 'youdao', 'deepseek') in the TLS Server Name Indication (SNI) field, combined with top-level domains like '.top' or '.vip'. This pattern indicates potential command and control (C2) communication from Gh0st RAT malware.
Sigma
