Ursnif Malware Command and Control URL Pattern Detection

SigmaHQ Detections@sigmaHQ

•updated Jun 12, 2025•1•0•24

Detects Ursnif C2 traffic by identifying specific URL patterns in proxy logs. The rule looks for URIs containing base64-like encoding indicators ('_2f', '_2b') in combination with specific file extensions and directory names ('.avi' and '/images/'). This combination is indicative of Ursnif malware's command and control communication.