SPECTRALVIPER C2 Beacon via Cookie Header zd_cs_pm= or euconsent-v2= Prefix

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects network connections where the HTTP request URL or specific HTTP cookies match patterns often associated with command and control infrastructure or specific tracking beacons. It triggers on connections to 'financemachinelearning.com/apparatus/wind/twig/statement.html' or requests containing cookies like 'zd_cs_pm' or 'euconsent-v2'.