msaRAT WebRTC DataChannel 0xFE ChaCha-Poly1305 C2 Handshake Frame

Duo Tech@duotech

•updated Jul 24, 2026•0•0•4

This rule detects UDP traffic patterns characteristic of the msaRAT C2 handshake. It specifically identifies initial WebRTC DataChannel connection frames containing the 0xFE marker combined with ChaCha-Poly1305 encryption indicators within the expected packet size range.