Fileless Payload Stored in Registry via HTTP C2

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects HTTP C2 traffic attempting to store a fileless payload in the Windows Registry. It specifically looks for HTTP responses (flow:to_client) containing the strings 'HKCU' (likely indicating a registry key path), 'powershell', and 'IEX' (Invoke-Expression), which are common indicators of PowerShell-based fileless malware using the registry for persistence or execution.