Custom Alphabet Base Encoding in C2 Traffic
This rule detects HTTP traffic where the client body contains a long string (100 or more characters) composed exclusively of uppercase letters and digits 2-7, potentially followed by padding characters. This pattern is indicative of custom alphabet base encoding, often used in Command and Control (C2) communications to obfuscate data.
Suricata
