DarkMe RAT rundll32 C2 registration and beaconing activity

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•8

This rule detects network activity associated with the DarkMe RAT, specifically targeting outbound TCP connections or DNS resolutions involving known C2 domains by the rundll32.exe process. This activity is indicative of the malware's post-injection C2 registration and beaconing.