MALWARE SHADOW-VOID-042 C2 Beacon (get_module_hello)

Tim Peck@timpeck

•updated Dec 11, 2025•0•54

This rule detects command and control (C2) beaconing activity associated with the SHADOW-VOID-042 malware family. Specifically, it looks for HTTP POST requests containing the string "get_module_hello" in the request body, which is indicative of a C2 communication pattern used by this malware.