VILE Ransomware Go HTTP/2 C2 Stack Detection
Detects outbound network communication originating from potential VILE ransomware processes. The rule monitors for suspicious Go-based HTTP clients using specific User-Agents (Go-http-client/2.0 or 1.1) initiating network connections to remote ports 80 or 443 with JSON payloads, while explicitly excluding common web browsers and internal RFC-1918 network ranges.
Cortex XDR
