DNS/connection to spoofed SilkParasite C2 hostnames

Arnold Chan@slaz

•updated Sep 21, 2026•1•0•6

Detects outbound network connections from devices to specific suspicious domains identified in the detection logic. This rule monitors for connections to 'ns2.asiainfo.it.com' and 'www.wordcheck.info', which may be indicative of malware communication, command and control, or malicious web activity.