Screening Serpens - UpdateChecker C2 Activity

Ibrahim Saud@tektrix

•updated Jun 19, 2026•2•0•4

This rule detects outbound Command and Control (C2) beaconing activity by the `UpdateChecker.dll` to Azure Websites, which is indicative of the Screening Serpens APT group. It specifically looks for the loading of `UpdateChecker.dll` followed by network connections to domains ending in `azurewebsites.net` from the same initiating process.