ATT&CK T1490 - Ransomware C2 Checkin Pattern

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects HTTP requests where the URI contains the string "ransom" (case-insensitive). This pattern is indicative of potential ransomware command and control (C2) check-ins, as ransomware often uses terms like 'ransom' in its communication with C2 servers.