Ousaban custom C2 command protocol response (inicio/fim host-porta structure)

Duo Tech@duotech

•updated Jul 2, 2026•1•0•2

This rule monitors network traffic for specific command-and-control (C2) communication patterns associated with the Ousaban banking trojan. It detects response packets from an external server to a client machine containing JSON-like structural indicators such as 'inicio{', 'host', and 'porta' followed by '}fim'.