Outbound TLS Connection to SparroWocky C2 Infrastructure

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•0

Detects outbound network connections (both TCP and TLS) from internal hosts to known command-and-control (C2) infrastructure associated with the SparroWocky malware family. This rule monitors for established connections to a curated list of malicious IP addresses over ports 443 and 8080.