BeepRAT C2 Beacon - TCP Port 18848 with ClientInfo/ClientPing Pattern

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects processes running from suspicious temporary directories (AppData, Temp, LocalAppData, TCC) initiating frequent outbound network connections to a specific non-standard destination port (18848). This behavior is often indicative of automated Command and Control (C2) heartbeats or beacons, particularly when associated with binaries executing from untrusted or user-writeable locations.