C2 Beaconing via Application Layer HTTP Protocol

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects potential C2 beaconing activity over HTTP. It specifically looks for HTTP GET requests where the URI path consists of 8 to 16 lowercase alphanumeric characters. The rule uses a threshold of 20 such requests within 60 seconds from the same source IP address to identify beaconing behavior.