SideCopy/ReverseRAT Known IOC Hunt - C2 IP & Domains (Sigma)

Arnold Chan@slaz

•updated Sep 22, 2026•1•0•6

Detects network connections to known SideCopy/ReverseRAT command-and-control infrastructure, including a static C2 IP address and two C2/hosting domains (matched exactly and as proper subdomains to avoid substring false positives).