Trickbot Malware C2 Detection

Ankit Mehta@Secvyn

•updated Jun 17, 2026•1•0•2

This rule detects potential Trickbot malware command and control (C2) communication by identifying network connections to specific remote URLs and ports commonly associated with Trickbot activity. It looks for multiple connections within an hour from the same device to these indicators.