sckit C2 HTTPS beaconing to skyleen.fr subdomains with fixed URI pattern

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•4

This rule detects outbound network beaconing from the SCKit malware to known command-and-control (C2) domains hosted on skyleen.fr or to a specific malicious IP address (139.84.223.178). The rule monitors both TLS SNI indicators in HTTPS traffic and direct IP connections to identify compromised hosts communicating with the attacker's infrastructure.