Cavern Manticore n-HTCommp.dll HTTPS/WebSocket C2 beacon - XOR(0x48)+Base64 encoded /gallery POST
Detects outbound HTTP POST requests to a /gallery URI endpoint, which is associated with Cavern Manticore C2 beacons. The detection logic inspects the HTTP request body for a specific Base64-encoded pattern following XOR 0x48 encoding, indicating potential command-and-control communication.
Suricata
