UNC6201 Iptables SPA Configuration

Tim Peck@timpeck

•updated Feb 18, 2026•1•0•33

Detects the execution of iptables commands used for Single Packet Authorization (SPA), a technique observed being used by UNC6201. This rule identifies when iptables is configured to inspect traffic on port 443 for a specific hex string, which is a key component of the actor's C2 proxying tradecraft.