C2 Commands Hidden in PNG Image File
This rule detects potential command and control (C2) activity where commands are hidden within PNG image files. It specifically looks for HTTP traffic flowing from the server to the client (to_client) that contains the PNG file signature (89 50 4E 47) within the first 4 bytes of the file data, and where the file size is greater than 100,000 bytes. A threshold is applied to trigger an alert if 10 such events occur within 60 seconds from the same destination IP address, indicating a potential high volume of C2 communication disguised as image downloads.
Suricata
