External Proxy Service Used to Mask C2 Origin

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects the use of an external proxy service to mask Command and Control (C2) origin. It specifically looks for HTTP traffic where the 'X-Forwarded-For' header is present and the HTTP method is 'CONNECT'. A threshold of 10 occurrences within 60 seconds from the same source IP is applied to reduce false positives.