Junk Data Padding in C2 HTTP Request
This rule detects HTTP POST requests from the home network to any destination that contain a large amount of junk data padding in the client body. Specifically, it looks for a client body size greater than 1000 bytes and a PCRE match for at least 500 alphanumeric characters, indicating potential command and control (C2) communication using data padding for obfuscation or to bypass detection. A threshold is set to trigger an alert if 10 such requests are observed from the same source within 60 seconds.
Suricata
