RC4 Symmetric Encrypted C2 Beacon Traffic
This rule detects HTTP POST requests with a client body that appears to be RC4 symmetric encrypted C2 beacon traffic. It specifically looks for HTTP traffic flowing to the server, with a client body between 100 and 500 bytes in size, and whose content matches a PCRE regex for base64 encoded strings. The rule is thresholded to trigger if 20 such events occur from the same source IP within 60 seconds, indicating potential beaconing activity.
Suricata
