ATT&CK T1071.001 - HTTP C2 Beacon: Regular Interval Requests

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects HTTP C2 beaconing activity characterized by regular interval GET requests. It specifically looks for 20 GET requests within a 60-second window from the same source IP address to any destination. This pattern is indicative of command and control communication, often used by malware to check in with its operators.