Compromised Host Botnet Beacon Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•2•0•4

This rule detects network traffic indicative of a compromised host attempting to beacon to a botnet command and control server. Specifically, it looks for HTTP requests where the URI path contains "/gate.php". This pattern is commonly associated with botnet communication.