Stealth Falcon PureRAT/.NET Stealer TLS C2 connection without SNI to known C2 infrastructure

Duo Tech@duotech

•updated Jul 21, 2026•1•0•4

Detects established TLS connections to known malicious infrastructure associated with PureRAT and DlrtyGames RAT. The rules identify suspicious patterns such as connections without a Server Name Indication (SNI) and specific JA3 hashes indicative of malware beacons.