Remcos RAT C2 Communication on Port 2404 and 37393
This rule detects outbound network connections from the internal network to external hosts on specific ports (2404, 37393) that are known to be used by the Remcos Remote Access Trojan (RAT) for command and control (C2) communications. The rule is designed to identify established TCP connections to the server.
Suricata
