CastleLoader - WebSocket C2 Communications

Ibrahim Saud@tektrix

•updated Jun 22, 2026•6•0•14

This rule detects the Python-based CastleLoader malware establishing persistent WebSocket (wss:// or ws://) command-and-control channels to randomized attacker endpoints. It specifically looks for network connections initiated by python.exe or pythonw.exe to URLs matching a WebSocket pattern, with at least 3 connections within a 5-minute window.