RatHat ADB Certificate/Key Exfiltration via /api/adbk/upload

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

This rule detects potential exfiltration of sensitive files, specifically 'cert.pem' and 'private.key', via HTTP POST requests to the '/api/adbk/upload' endpoint. This pattern is characteristic of the RatHat malware attempting to exfiltrate device credentials to a Command and Control (C2) server.