Remote Access Tool Download After Phone Contact
This rule detects the download of common Remote Access Tools (RATs) such as AnyDesk, TeamViewer, UltraViewer, RustDesk, and Zoho Assist. It specifically looks for these keywords in the HTTP URI during client-to-server HTTP traffic. The rule is categorized as 'trojan-activity' and is intended to alert when a user might be downloading these tools, potentially after social engineering or phone contact, as suggested by the rule's message.
Suricata
