Xray-core Implant Sideloading Artifacts (wkspbroker/radcui.dll)

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•3

Detects the presence of file artifacts associated with the Xray-core proxy tool when used as an implant via DLL sideloading. The rule identifies specific files (radcui.dll, config.json, comsrv.dat, KB85809588.bat) or malicious configuration patterns indicating proxy traffic (VLESS/VMess/outbound/inbound) targeting known C2 endpoints.