BabylonRAT C2 Beaconing via Firefox User-Agent on Non-Standard Port

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•0

This rule detects potential BabylonRAT C2 beaconing activity by monitoring for recurring outbound HTTP GET requests using a 'Firefox' User-Agent string on non-standard HTTP ports. The threshold mechanism specifically flags repeated connections within a short time frame, which is characteristic of malware beaconing behavior.