Bidirectional C2 via Discord Webhook

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects potential bidirectional command and control (C2) activity leveraging Discord webhooks. It specifically looks for HTTP POST requests to 'discord.com' with the URI containing '/api/webhooks/'. A threshold of 5 such requests within 60 seconds from the same source IP is set to reduce false positives and indicate sustained communication, characteristic of C2.