INTERLOCK NodeSnake RAT WebSocket beacon URI (v=4)

Collin Lairamore@Bollinmore

•updated Jul 28, 2026•0•0•0

This rule detects a specific WebSocket handshake pattern associated with the NodeSnake RAT. It specifically identifies an HTTP GET request containing a 'Sec-WebSocket-Key' header and a specific URI query parameter '?v=4|3b|', which indicates beaconing activity characteristic of this RAT's communication channel.