Kazuar - Deeply Nested C2 URI Beaconing (T1071.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•2

Identifies HTTP connections exhibiting Kazuar's distinct long, deeply nested URL path structures mimicking legitimate API endpoints. The rule specifically looks for URLs matching the pattern /api/v[1-3]/[a-z]+/[a-z]+/[a-f0-9]{32}/, which indicates a versioned API path followed by two alphabetical segments and a 32-character hexadecimal string, characteristic of Kazuar C2 beaconing.