TrickBot C2 Group Tag Exfiltration via HTTP POST on Port 447/449

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule monitors for HTTP POST requests to external networks containing 'gtag=' in the URI, which is a known technique used by the TrickBot malware to exfiltrate its group identifier during C2 communication.