Empire C2 Communication via Specific User-Agent and URI Paths

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•4•0•33

This rule detects HTTP POST requests that exhibit characteristics commonly associated with the Empire post-exploitation framework. Specifically, it looks for a combination of a distinct user-agent string ('Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko') and specific URI paths ('/admin/get.php', '/news.php', '/login/process.php'). This pattern is indicative of an Empire agent communicating with its command and control server.