Operation DragonReturn DcRAT C2/Staging IPs (CTG Server AS152194)

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

This rule identifies endpoints making network connections to a set of known suspicious or malicious IP addresses. It aggregates the number of connections and the variety of processes initiating these connections, allowing analysts to identify potential command and control (C2) communication patterns from compromised hosts.