Removed rule. This rule is known, but it is no longer present in its source. Showing the last known version.Removed: Jun 28, 2026, 11:41 PM
ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)
Sourceabuse.ch/threatfox
Filethreatfox_suricata.rules
CreatedJune 25, 2026
UpdatedJune 25, 2026
Classificationtrojan-activity
alert tcp $HOME_NET any -> [41.103.8.159] 999 (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)" ; threshold:type limit, track by_src, seconds 60, count 1 ; reference:url, threatfox.abuse.ch/ioc/1687868/ ; target:src_ip; metadata:confidence_level 100, first_seen 2025_12_28; classtype:trojan-activity; sid:91687868; rev:1;)
References
Metadata
confidence level100
first seen2025_12_28
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!