Devil Bait C2 Communication via HTTP GET Requests

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•24

Detects potential C2 communication related to Devil Bait malware by identifying specific URI patterns in GET requests. The rule looks for URIs containing '/cross.php?op=', '&dt=', and '&uid=' which are indicative of Devil Bait's communication with its command and control server.