RatHat ADB Certificate and Private Key Exfiltration to C2

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

This rule detects potential credential exfiltration by the RatHat malware, which attempts to upload 'cert.pem' and 'private.key' files to a remote server using a POST request to '/api/adbk/upload'.