VSHELL RAT CDN Traffic Blending via Non-Browser Process DNS/Network to Akamai and MSN Domains

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

This rule detects processes other than common web browsers (e.g., chrome, firefox, msedge) initiating outbound network connections on ports 80, 443, or 8084 to specific domains commonly associated with CDN, telemetry, or cloud-based update services. This behavior might indicate unauthorized processes communicating with external infrastructure, potentially for command and control or data exfiltration, masquerading as legitimate traffic.