Beaconing to SilkParasite SpiceRAT C2 IP Set

Arnold Chan@slaz

•updated Sep 19, 2026•0•0•2

This rule detects network connections from internal devices to known SpiceRAT Command and Control (C2) infrastructure IPs. The detection filters for successful connections on common ports (80, 443) that meet a volume threshold, indicating potential ongoing beaconing or communication with malicious infrastructure.