INTERLOCK NodeSnake RAT cleartext WebSocket upgrade to IP literal host

Collin Lairamore@Bollinmore

•updated Jul 28, 2026•0•0•4

This rule detects potential command-and-control (C2) activity related to the NodeSnake RAT. It specifically identifies cleartext HTTP requests attempting to initiate a WebSocket upgrade (using the Sec-WebSocket-Key header) while the target host is specified as an IP address literal rather than a domain name, which is a common indicator of hardcoded or non-DNS-dependent C2 infrastructure.