RatHat C2 registration via /api/node/register endpoint

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•2

Detects HTTP POST requests to the specific '/api/node/register' URI, which is associated with the RatHat RAT command and control (C2) node registration behavior.