C2 Channel Switch to New Infrastructure Detected

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects potential command and control (C2) channel activity by identifying HTTP requests where the URI contains specific keywords commonly associated with C2 infrastructure switching or staging. The keywords include 'stage2', 's2', 'next', 'pivot', and 'relay'. This indicates an attacker might be moving to a new phase of their operation or redirecting C2 communications.