SPECTRALVIPER Downloader POST Beacon to /V1/Update/GetUpdate
This rule detects potentially malicious HTTP POST requests directed at a specific URI path ('/V1/Update/GetUpdate') associated with software update functionality. It identifies suspicious traffic by analyzing parameters in the request body (such as Id, Hostname, Mac, Version, Arch) and potential process names (e.g., setup.exe, IntelAudioService.exe). High-risk scores are assigned based on the destination IP and the presence of these specific identifying parameters, which may indicate command-and-control (C2) beaconing or data exfiltration masquerading as legitimate update check traffic.
Splunk (SPL)
