PowerShell Empire C2 Beacon Pattern

Darshan Thummar@Mighty

•updated Jun 10, 2026•1•0•3

This rule detects a PowerShell Empire C2 beacon pattern over HTTP. Specifically, it looks for HTTP POST requests to '/index.jsp' where the client body contains a base64-like encoded string of at least 200 characters, indicated by the PCRE pattern. This pattern is characteristic of how PowerShell Empire agents communicate with their command and control server.