C2 over serverless worker function - soraki-proxy.workers.dev

Arnold Chan@slaz

•updated Sep 12, 2026•1•0•2

This rule detects command-and-control (C2) communication patterns associated with the 'soraki-proxy.workers.dev' domain, a Cloudflare Workers-hosted proxy service. Additionally, it identifies potential malicious mTLS implants by flagging non-standard TLS handshakes that use self-signed or auto-generated certificates missing standard organization (O) fields in the subject DN.