MexicanMafia SSL Private Key Exfiltration via Netcat to 62.171.185.97

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•5

Detects the unauthorized exfiltration of SSL private key files using Netcat to a known malicious C2 IP address (62.171.185.97). The rule monitors process execution commands that include specific file names associated with certificate harvesting or extraction tools being piped or transmitted over the network.