SnappyClient RAT C2 beaconing over encrypted ports 3333/3334
Detects recurring connection patterns characteristic of the SnappyClient RAT, specifically monitoring for heartbeat-like beaconing at regular intervals on ports 3333/tcp and 3334/tcp. The rule correlates traffic across both ports from the same device to the same destination to identify potential command-and-control communication.
Microsoft Sentinel (KQL)
