BotHelper RAT C2 TLS SNI easyllms.xyz check-in

Ankit Mehta@Secvyn

•updated 29 days ago•2•0•2

Detects network traffic associated with the BotHelper RAT communicating with its C2 domain 'easyllms.xyz'. The rule monitors for TLS SNI connections to this domain and specific HTTP API paths (/api/v1/ping, /api/v1/connect, etc.) indicative of command-and-control heartbeats and task execution.