AI Brands as Bait - Network Conn followed by SQLite Read

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

This rule detects suspicious activity where a Python process initiates network communication to known command and control (C2) domains, immediately followed by accessing SQLite database files (e.g., 'places.sqlite' or 'Cookies'). This pattern is indicative of malware or adversary activity attempting to exfiltrate browser history or session cookies after establishing C2.