ET MALWARE OysterLoader Stage3 Registration /reg

Daniel Jeremiah@daniyyell

•updated Feb 23, 2026•2•0•36

This rule set detects various stages of the OysterLoader malware activity, including its registration and login attempts to a command and control (C2) server, specific C2 communication patterns via HTTP URIs, and connections to known OysterLoader C2 domains and IP addresses. The rules look for specific HTTP URI paths like "/reg" and "/login" combined with distinct User-Agent strings ("WordPressAgent" and "FingerPrint"), as well as specific API paths under "/api/" and hardcoded C2 domains and IP addresses.