Nimbus Manticore - Azure Polling URI Traversal (T1071.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

This rule detects network connections to AzureWebsites (specifically '.azurewebsites.net') where the URI path matches patterns used by the Nimbus Manticore implant for command and control polling or initialization. The patterns include '/agent/poll?token=' or '/agent/init' or '/agent/result'. This indicates potential communication with a Manticore implant hosted on an Azure web app.