HTTP POST Beaconing to Single External IP

Jorden Smith@Jorden

•updated Feb 10, 2026•0•28

This rule detects multiple HTTP POST requests originating from the same host to the same external IP address within a 10-minute window, with a minimum of 5 such events. This pattern is indicative of potential command and control (C2) beaconing activity, where a compromised system periodically communicates with an external server.