Ransomware C2 IP Detection

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•1

Detects network connections to known or suspected Command and Control (C2) IP addresses and ports associated with ransomware activity. This rule specifically looks for outbound connections from devices to a predefined list of suspicious remote IP addresses on common C2 ports (443, 8443, 6379, 27017).