Turb00 Vidar/SnappyClient process launch followed by repeated beaconing to C2/dead-drop infrastructure
This rule detects the execution of known Vidar or SnappyClient loader processes (NeuroManag.exe or VirtualAr.exe) followed by repeated network connections to specific C2 infrastructure IP addresses or common dead-drop resolver services such as Telegram, Steam, or specific attacker-controlled domains. The rule identifies suspicious beaconing behavior following the process launch, indicating active command and control communication.
YARA-L
