SideCopy/ReverseRAT Known IOC Hunt (Hashes, C2 IP/Domains, URLs)

Arnold Chan@slaz

•updated Sep 22, 2026•1•0•2

This rule detects potential malicious activity by monitoring for known indicators of compromise, including specific SHA256 file hashes, a known malicious IP address, and URLs associated with identified threats. The detection spans file creation/execution, network connections, and URL visits to block or alert on interactions with suspicious infrastructure.