Raw TCP C2 to hardcoded 193.26.115.131:15152 with JSON outbound envelope

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•9

Detects network traffic consistent with a hardcoded C2 channel used by PolinRider or NullReceiver malware families. The rule monitors TCP traffic directed to a specific IP address (193.26.115.131) and port (15152) that contains serialized command/status structures formatted with specific JSON-like content patterns.