StealC C2 HTTP POST to Hexadecimal PHP Endpoint
Detects HTTP POST requests directed at PHP script endpoints with randomized 16-32 character hexadecimal filenames, which is a known C2 communication pattern used by the StealC infostealer.
Sigma
Detects HTTP POST requests directed at PHP script endpoints with randomized 16-32 character hexadecimal filenames, which is a known C2 communication pattern used by the StealC infostealer.
Already have an account?