Dead Drop Resolver Using GitHub Gist for C2

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•6

This rule detects HTTP traffic where the host is 'gist.github.com' and the URI contains '/raw/', indicating a potential Dead Drop Resolver using GitHub Gist for Command and Control (C2) activities. It triggers an alert if five such connections are observed from the same source IP within 300 seconds.