SparroWocky TLS C2 Traffic to Known IP Infrastructure

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•0

Detects network communication to known malicious infrastructure associated with the SparroWocky malware, often used by the FamousSparrow threat actor. The rule monitors for established TCP or TLS-encrypted connections on ports 443 and 8080 directed toward specific IP addresses identified as part of the C2 infrastructure.