Multi-Stage C2 Stage Two Payload Download

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•6

This rule detects the download of a multi-stage Command and Control (C2) stage two payload. It specifically looks for HTTP traffic where the referer header contains 'pastebin', 'github', 'discord', or 'telegram' (case-insensitive) and the file data starts with 'MZ', indicating a Windows executable. This combination suggests a potential malicious download from common code/file sharing platforms often used by attackers for C2 infrastructure.