Post #3563262
2026-07-03 18:43 UTC
@da_667@infosec.exchange @james_inthe_box@infosec.exchange Here's another older PureRAT C2 from JoeSandbox with the same CN = PureRAT Agent, but on the classic 56001 PureRAT port.
Replies (1)
-
@da_667@infosec.exchange 2026-07-03 18:45
@netresec@infosec.exchange @james_inthe_box@infosec.exchange yeah I ended up sigging on the tls.cert_issuer via Suricata, so that should provide some reliable detection regardless of what random port they use.