Malware Impersonating Browser Traffic for C2
This rule detects HTTP traffic that attempts to impersonate legitimate browser traffic (specifically Chrome on Safari) for command and control (C2) purposes. It looks for a specific User-Agent pattern that mimics Chrome on Safari and a URI pattern consisting of 8 to 16 lowercase alphanumeric characters. A threshold is applied to prevent excessive alerts, triggering if 20 such events occur within 60 seconds from the same source.
Suricata
