AES Encrypted C2 Channel with Hardcoded Key Pattern
This rule detects potential command and control (C2) communication over TCP that uses AES encryption with a hardcoded key pattern. It specifically looks for the byte sequence "41 45 53" (which corresponds to the ASCII string "AES") within the payload of a TCP flow from the internal network to any external destination. The rule further refines detection by checking for a payload size between 100 and 500 bytes and applies a threshold of 20 occurrences within 60 seconds from the same source IP to reduce false positives. This pattern is indicative of certain malware families that use predictable AES keying for their C2 channels.
Suricata
