StealC C2 Registration HTTP POST to Known C2 Domains via .php Endpoint

Ibrahim Saud@tektrix

•updated Jun 24, 2026•2•0•6

This rule detects network activity associated with the StealC information stealer, specifically focusing on HTTP POST requests made to known command-and-control (C2) domains. It identifies characteristic URL patterns, such as randomly generated 16-character PHP files or specific index.php structures, which are used for bot registration and communication. The detection includes patterns indicative of RC4-encrypted payloads and behavior mimicking Amadey bot status checks.