Cavern Manticore C2 traffic - fixed Edge User-Agent with X-User-token header

Duo Tech@duotech

•updated Jul 6, 2026•0•0•5

Detects network traffic associated with Cavern Manticore command-and-control communication. The rule identifies a specific HTTP request pattern characterized by a static User-Agent string resembling a Chrome/Edge browser on Windows and the inclusion of a specific 'X-User-token' header in the HTTP request.