TRUSTRAP C2 tunneling via non-standard protocol wrapping on common ports

Ibrahim Saud@tektrix

•updated Jul 2, 2026•2•0•9

Detects network activity initiated by a process named 'Trustrap' communicating over common ports (80, 443, 53). The rule aggregates data by endpoint, process, and port, sorting by the frequency of connections to highlight potentially high-volume communication patterns.