SnappyClient RAT Control/Data Channel Beaconing (Ports 3333/3334)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•5•0•7

This rule detects potential network port scanning behavior by identifying a host that initiates connections to both ports 3333 and 3334 on a remote destination within a short time window (15 seconds). This specific pattern is often associated with automated discovery or lateral movement tools probing for specific services.