Xray-core C2 via spoofed dl.google.com SNI from wkspbroker.exe sideload

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•9

Detects Xray-core C2 tunnel traffic where the TLS SNI is spoofed to appear as 'dl.google.com'. The detection specifically looks for this behavior originating from non-browser processes such as 'wkspbroker.exe' or 'radcui.dll', which is indicative of malicious tunneling activity.