SilverFox relay dispatcher api.php/relays.json request pattern

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•4

This rule detects network activity associated with the SilverFox malware, specifically targeting communication patterns between the compromised host and identified relay infrastructure. The detection focuses on unique URL query patterns for relay discovery and dispatcher requests, as well as the identification of staging/download links within server responses.