ATT&CK T1219 - RAT C2 Common Port 8888

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects TCP connections to port 8888, which is commonly used by Remote Access Trojans (RATs) for Command and Control (C2) communications. The rule specifically looks for the SYN flag in the TCP handshake, indicating the initiation of a new connection from the internal network ($HOME_NET) to any external destination.