C2 URL Embedded in User-Agent

nomit vyas@xoxo

•updated Feb 6, 2026•0•65

Detects HTTP requests where the User-Agent string contains a full URL pointing to 'temp.sh'. This technique was observed in the Notepad++ supply chain attack where attackers passed the URL of exfiltrated data back to their C2 server within the User-Agent header.