Botnet C2 Panel Access Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•1•0•5

This rule detects potential access to a botnet command and control (C2) panel. It triggers when HTTP URI requests contain both 'panel' and 'bot' (case-insensitive) within the URI. A threshold of 5 such requests from the same source within 60 seconds is set to reduce false positives.