Chaos msaRAT - STUN/TURN token request to Cloudflare Workers domain with spoofed Microsoft Origin/Referer and HeadlessChrome UA
Detects network traffic indicating msaRAT behavior where a host initiates a STUN/TURN token request to a Cloudflare Workers (.workers.dev) domain. The rule identifies suspicious characteristics including spoofed Microsoft-related Origin or Referer headers and a HeadlessChrome User-Agent, commonly used by automated C2 communication.
Suricata
