Obfuscated Protocol Data in Non-Standard C2 Channel

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•6

This rule detects obfuscated protocol data in non-standard command and control (C2) channels over TCP. It triggers when TCP traffic flows from the home network to any destination, is established, has a data size between 101 and 499 bytes, and occurs at a high frequency (30 times in 60 seconds from the same source). This pattern is indicative of trojan activity, specifically related to command and control communications.