Removed rule. This rule is known, but it is no longer present in its source. Showing the last known version.Removed: Jul 5, 2026, 4:07 AM

THL - XiebroC2 v3.1 TCP C2 Beacon - Known C2 IP Port 4444

SID: 1900046Rev: 1Enabled1 viewsHistory
Filehunters-ledger.rules
CreatedApril 3, 2026
UpdatedApril 3, 2026
Classificationtrojan-activity
alert tcp $HOME_NET any -> 193.56.255.154 4444 (msg:"THL - XiebroC2 v3.1 TCP C2 Beacon - Known C2 IP Port 4444"; flow:established,to_server; threshold:type both, track by_src, count 1, seconds 300; classtype:trojan-activity; reference:url,pixelatedcontinuum.github.io/Threat-Intel-Reports/hunting-detections/opendirectory-193-56-255-154-20260403-detections/; sid:1900046; rev:1; metadata:affected_product Windows, attack_target Client_Endpoint, created_at 2026_04_03, deployment Perimeter, malware_family XiebroC2, signature_severity Critical, tag C2;)

References

urlpixelatedcontinuum.github.io/Threat-Intel-Reports/hunting-detections/opendirectory-193-56-255-154-20260403-detections/

Metadata

affected productWindows
attack targetClient_Endpoint
created at2026_04_03
deploymentPerimeter
malware familyXiebroC2
signature severityCritical
tagC2

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!