Sauron Loader-style TLV C2 registration via rotating HTTPS URI paths

Ibrahim Saud@tektrix

•updated Sep 26, 2026•0•0•4

Detects HTTP beaconing patterns and TLS SNI traffic associated with the Sauron Loader malware. The rules identify specific URI structures (including versioned resources and various configuration/profile endpoints), specific URL parameters used for session management, and characteristic User-Agent strings. Additionally, it monitors for connections to known command-and-control infrastructure via TLS SNI filtering.