VSHELL RAT WebSocket C2 to 38.60.253.35 on port 8084

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

This rule detects network traffic indicative of command and control (C2) activity using the WebSocket protocol targeting a specific suspicious destination IP (38.60.253.35). The rule identifies WebSocket connections or traffic containing specific URL parameters ('a=w64', 't=ws_') commonly associated with malicious tooling or C2 communication patterns.