NightshadeC2 C2 Communication Detection

Tim Peck@timpeck

•updated Sep 5, 2025•3•1•71

This rule detects potential C2 communication patterns associated with the NightshadeC2 botnet. It looks for outbound TCP connections from non-browser processes to specific ports used by the malware, or connections to Steam community pages which are used to host C2 addresses. It also identifies initial geo-IP lookups from non-browser processes.