ProRAM WebSocket-over-TLS C2 beacon to clash-verge-upgrade.com

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•2

Detects network activity associated with the ProRAM C2 infrastructure. The rule monitors for DNS resolutions, TLS SNI field matches, and specific HTTP WebSocket upgrade patterns directed towards the 'clash-verge-upgrade.com' domain.