KNTRAT C2 beaconing to 65.87.7.132 or kntrat/0xB15B00B6 user-agent

Suraj A@cytech

•updated 4 days ago•0•0•1

Detects network communication associated with the KNTRAT (NEBULA campaign) command and control infrastructure, specifically identifying connections to a known C2 IP address on ports 443 or 1434, or traffic containing the custom KNTRAT user-agent string in HTTP requests or additional event fields.