Possible UDP C2 or Data Exfiltration

Ankit Mehta@Secvyn

•updated Mar 18, 2026•7•0•73

This rule detects network connections to specific IP addresses and ports (1259, 1269) via UDP, or the presence of a file with a specific SHA256 hash. This combination could indicate command and control (C2) communication or data exfiltration using a custom UDP protocol.