BlackBeard Data Exfiltration in HTTP Expires Header
Detects potential data exfiltration by the BlackBeard backdoor, associated with Boggy Serpens (MuddyWater). The malware abuses the HTTP 'Expires' header in client requests to exfiltrate encrypted system data to its command and control server. The 'Expires' header is a standard response header, so its presence in a request is highly anomalous.
Sigma
