SloppyRAT Reverse SOCKS Proxy via /api/poll and /api/proxy/ack

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•3

Detects network traffic associated with the SloppyRAT backdoor, which utilizes a reverse SOCKS proxy mechanism. The rule identifies specific HTTP GET/POST heartbeats and command responses to the '/api/poll' and '/api/proxy/ack' endpoints commonly used for C2 operations.