PEEP Browser RAT HTTP C2 Beacon to /api/commands

Arnold Chan@slaz

•updated Sep 8, 2026•0•0•2

This rule detects network traffic indicative of the PEEP Browser RAT, specifically HTTP beacons targeting the URI path '/api/commands'. It monitors for unique HTTP headers ('X-PEEP-Agent-Id', 'X-PEEP-Agent-Key') and connections to known malicious infrastructure.