Multiple HTTP Requests with Small Response Bodies

Jorden Smith@Jorden

•updated Feb 10, 2026•0•19

Detects HTTP C2 beaconing patterns based on multiple requests (at least 5 within 5 seconds) to the same destination (source IP, destination IP, and destination port) where each request has a small response body (between 1 and 499 bytes). This rule correlates with 'Small HTTP Response Body' to identify burst request counts indicative of C2 activity.