DKnife AitM C2 Beacon Detection

Ethan Andrews@eandrews

•updated Feb 5, 2026•2•0•41

This query detects network traffic patterns associated with the DKnife Adversary-in-the-Middle (AitM) framework. Specifically, it looks for triggers used by the DarkNimbus backdoor to request C2 information from a compromised gateway. This includes HTTP requests to a specific Baidu URL used by the Android variant and UDP traffic to port 8005 used by the Windows variant.