Amatera C2 Communication via Host Spoofing
Detects network connections to a known Amatera Stealer C2 IP address where the HTTP Host header is spoofed. This technique is used by the malware to masquerade its C2 traffic, often by using a legitimate-looking or unrelated domain in the Host header, while communicating directly with the malicious IP address.
Sigma
