SnappyClient RAT encrypted C2 beaconing via periodicity and destination rarity on ports 3333/3334
Detects periodic, low-variance network beaconing behavior indicative of the SnappyClient RAT, specifically monitoring for simultaneous connections to control (port 3333) and data (port 3334) ports. The detection utilizes statistical analysis of inter-arrival times (low coefficient of variation) and restricts alerts to rare destination IP addresses contacted by a limited number of internal hosts.
Splunk (SPL)
