Malicious C2/URL Host Network Activity

Rudra Verma@Rudraverma

•updated Feb 5, 2026•28•1•146

This rule detects network connections and DNS resolutions to a predefined list of known malicious IP addresses and domains. It also identifies HTTP requests containing specific URL paths ('update/update.exe', '/users/admin', '/api/') when made to these malicious IPs. This behavior is indicative of potential command and control (C2) communication or malware attempting to download updates or exfiltrate data.