DcRAT C2 on 223.26.63.40:2671 and Beaconing via Port 2671 (Operation DragonReturn)
Detects network traffic associated with DcRAT malware, specifically monitoring outbound connections on port 2671 to external non-private IP addresses, or directly to known malicious infrastructure (223.26.63.40). The rule also identifies potential beaconing behavior by analyzing connection intervals and standard deviation, and flags activity originating from specific autonomous system ranges (AS152194) linked to the threat actor's infrastructure.
Splunk (SPL)
