Internal Proxy Server Used to Route C2 Traffic

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects the use of an internal proxy server to route C2 (Command and Control) traffic. Specifically, it looks for HTTP CONNECT requests within the internal network ($HOME_NET to $HOME_NET) that are established and occur at a high frequency (10 times in 60 seconds from the same source). This pattern is indicative of a system inside the network attempting to tunnel C2 communications through an internal proxy.