BeepRAT Screen/Webcam Capture Exfiltration via C2 (Operation DragonClone)
Detects BeepRAT malware activity, including network communication to its command-and-control (C2) server on port 18848 and the creation of screenshot or video artifacts by known loader processes (HFY.exe, LuaJit.exe, tcc.exe). It also monitors for unauthorized network connections to the known BeepRAT C2 IP address.
SentinelOne
