JetBrains Remote IDE Tunnel Used for C2 Access
This rule detects HTTP traffic to JetBrains Remote IDE tunnel domains (jetbrains.space or gateway.jetbrains.com). This activity is flagged as potential Command and Control (C2) communication, specifically leveraging remote access software for malicious purposes. A threshold of 10 connections within 60 seconds from a single source IP is set to reduce alerts on legitimate, less frequent usage.
Suricata
