Regular Interval Application Protocol C2 Beacon

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects potential command and control (C2) beaconing activity over HTTP. It specifically looks for HTTP POST requests with a content size between 50 and 300 bytes that occur at a regular interval (15 times in 60 seconds) from a single source IP address. This pattern is often indicative of malware communicating with a C2 server.