Adobe Reader/Acrobat Network Connection to Malicious C2

Taylor Parizo@axelarator

•updated Apr 10, 2026•13•0•491

This rule detects outbound network connections from Adobe Reader (AcroRd32.exe) or Adobe Acrobat (Acrobat.exe) processes on Windows platforms to known malicious C2 IP addresses. This activity is indicative of potential compromise, likely stemming from an exploit targeting Adobe products, as observed in a sophisticated zero-day campaign.