AMQP Message Queue Used as C2 Channel

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects the use of AMQP (Advanced Message Queuing Protocol) on port 5672, specifically looking for the 'AMQP' content within the first 4 bytes of the TCP payload. It triggers an alert if this pattern is observed 5 times within 60 seconds from the same source IP, indicating potential Command and Control (C2) activity using AMQP as a communication channel.