Banana RAT Opens an Encrypted Remote Control Channel
Detects a banking trojan process establishing TLS communication immediately after loading input, capture, and overlay modules. The rule specifically looks for network connections initiated by processes with names like 'banana', 'client', 'update', 'service', or 'host' (case-insensitive) and command lines indicating SSL/TLS communication or remote control functionality.
CQL
