TiFlux RMM - Outbound Cloud C2 Connection

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•3

This rule detects continuous outbound HTTPS beaconing from the TiFlux RMM agent to its central cloud infrastructure. It identifies processes with names matching 'tiflux.*.exe' making frequent connections to domains ending in '.tiflux.com', '.tiflux.io', or '.tiflux.net' on port 443, with more than 10 beacons within a 10-minute window.