Outbound TLS Connection to Known SparroWocky C2 IP Infrastructure

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•0

Detects outbound TLS connections from internal hosts to known IP addresses associated with the SparroWocky command-and-control infrastructure, including the specific byte sequence used during the TLS handshake to signal a ready state.