XOR Encoded C2 Traffic Pattern

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects HTTP client body traffic that appears to be XOR encoded, characterized by a long sequence of non-printable ASCII characters (bytes 0x01-0x1f and 0x7f-0xff) of at least 50 characters. This pattern is often indicative of Command and Control (C2) communication used by malware to evade detection.