x47.c SOCKS5 reverse-proxy REVERSE_PROXY handshake to C2

Ankit Mehta@Secvyn

•updated 8 days ago•0•0•0

Detects network traffic consistent with the x47.c bot performing a SOCKS5 reverse-proxy handshake to a command-and-control (C2) server. The rule triggers on the specific 'REVERSE_PROXY|' string signature within established outbound TCP connections.