QUIC C2 traffic using self-signed RAT CA certificate

Emiliano Mema@Nosalva

•updated Aug 27, 2026•0•0•2

This rule detects QUIC network traffic where the TLS certificate subject and issuer match specific patterns associated with 'RAT System' and 'RAT CA'. This signature indicates potential command-and-control (C2) communication utilizing self-signed certificates for authentication pinning in an attempt to masquerade or secure malicious traffic.