Goofy Guineapig Backdoor Potential C2 Communication
This rule detects potential Command and Control (C2) communication associated with the Goofy Guineapig backdoor. It specifically looks for HTTP/S requests originating from a user agent string characteristic of the malware ('Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36') communicating with the domain 'static.tcplog.com'. This combination of user agent and destination domain is indicative of Goofy Guineapig C2 activity.
Sigma
