Showboat - SKS/MAP URI Parameter Beaconing

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Inspects network connection URIs for the SKS= or MAP= parameters, which are used by the Showboat malware to initialize proxy tunnels. This rule specifically looks for these parameters in HTTP connection events.