XWorm Malware Network and Process Activity

Kaung Khant Ko@kaungkhantko

•updated Sep 12, 2025•8•0•89

Detects network connections to known XWorm Command and Control (C2) infrastructure (IPs and domains) and the creation of processes with filenames associated with XWorm malware. This rule combines network and process-based indicators to identify potential XWorm infections.