SideCopy/ReverseRAT Known IOC Hunt (Hashes, C2 IP/Domains, URLs)

Arnold Chan@slaz

•updated Sep 22, 2026•0•0•2

This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.