Non-Standard Encoding Used in C2 HTTP Body

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•6

This rule detects HTTP traffic where the client body contains a long string of hexadecimal characters, which could indicate the use of non-standard encoding for Command and Control (C2) communication. The rule specifically looks for a hexadecimal string of at least 200 characters in the HTTP client body.