Chafer Malware C2 HTTP URI Pattern

SigmaHQ Detections@sigmaHQ

•updated Jun 12, 2025•0•29

Detects HTTP requests containing the URI pattern '/asp.asp?ui=' which is known to be used by the Chafer malware for command and control communication to receive data from its C2 server.