Multiple HTTP Requests with Small Response Bodies (C2 Beaconing)

Jorden Smith@Jorden

•updated Jan 8, 2026•0•55

Detects HTTP C2 beaconing patterns based on burst request counts with small response bodies (1-499 bytes). This rule correlates multiple HTTP requests to the same destination within a short timespan, where each response has a small body size. This pattern is indicative of command and control (C2) communication.