Emotet HTTP C2 POST Randomized URI with octet-stream Content-Type

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•4

This rule detects outgoing HTTP POST requests containing patterns commonly associated with Emotet command-and-control (C2) communication, specifically identifying the use of an application/octet-stream content type combined with a specific, randomized URI path structure consisting of alphanumeric segments.