Internal HTTP Proxy Port Used for C2 Relay
This rule detects potential command and control (C2) activity where an internal HTTP proxy port (8080) is used as a relay. Specifically, it looks for HTTP CONNECT requests, which are commonly used for tunneling through proxies, directed to port 8080 within the home network. A threshold of 10 such requests within 60 seconds from a single source IP triggers the alert, indicating suspicious proxy usage for C2 communication.
Suricata
