C2 Config Retrieved from Pastebin Dead Drop

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects attempts to retrieve C2 configuration from Pastebin, specifically looking for HTTP requests to 'pastebin.com' that include '/raw/' in the URI. It uses a threshold of 5 occurrences within 300 seconds from the same source to reduce false positives.