RatHat - FRP client (frpc) reverse tunnel handshake to C2

Arnold Chan@slaz

•updated Sep 18, 2026•0•0•5

Detects the specific TCP handshake pattern characteristic of the Fast Reverse Proxy (FRP) client (frpc) initiating a connection to a command-and-control server. The rule inspects established traffic for specific metadata strings ('privilege_key', 'run_id', 'pool_count') within the initial handshake payload.