Matanbuchus - Beaconing C2 Check-in (T1071.001)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

This rule detects continuous C2 beaconing activity associated with Matanbuchus malware. It specifically looks for network connections originating from 'svchost.exe' or 'dllhost.exe' to common web ports (80, 443, 8080) with a high frequency (more than 10 beacons) within a 5-minute window. This behavior is indicative of a hollowed process establishing command and control communication.