INTERLOCK NodeSnake RAT WebSocket beacon URI (any protocol version)

Collin Lairamore@Bollinmore

•updated Jul 28, 2026•0•0•1

This rule detects the initial WebSocket handshake request used by the INTERLOCK NodeSnake RAT for beaconing. It looks for a GET request containing a 'Sec-WebSocket-Key' header and a specific URI pattern (?v=n;) common to the RAT's communication profile.