topic Re: Threat ID 86798 - BruteRatel C4 Command and Control Traffic Detection in Advanced Threat Prevention Discussions

Threat ID 86798 - BruteRatel C4 Command and Control Traffic Detection

MarcinWSTD — Thu, 21 Sep 2023 13:49:29 GMT

Hi all,

since yesterday I see this threat as a critical. I suppouse that is false posotive action.

Didn't find any suspicious actions on the computer and just want to know is there any of you that have observed similar alerts?

Maybe I have to dig deeper.

Thanks,

OtakarKlier — Thu, 21 Sep 2023 19:58:25 GMT

Hello,

I have not, but doesnt mean no one else has. I would enable extended packet capture on threats and then submit the pcap to support for review.

Regards,

MarcinWSTD — Fri, 22 Sep 2023 08:54:23 GMT

Thanks for that. I will take a look into it.

I can see rare occurence for that suspicious behavior.

I've implemented extended packet logging already and will see what to do next ...