Process Injection C2 Beacon from Injected Process
This rule detects C2 beaconing activity originating from a potentially injected process. It specifically looks for HTTP traffic where the User-Agent header matches a common Windows Mozilla/5.0 pattern, indicating a Windows client, and the data size is between 1 and 199 bytes. A threshold of 20 such events within 60 seconds from the same source IP triggers the alert, suggesting a beaconing behavior.
Suricata
