Go RAT encrypted raw-TCP C2 session to known GapiUpdate campaign IP on port 5556
Detects established raw-TCP C2 communication sessions associated with the GapiUpdate Go-based RAT, identifying both known malicious infrastructure and behavioral anomalies characteristic of long-lived, encrypted C2 persistence.
Suricata
