BlueNoroff ClickFix C2 execute-link with AES-GCM encrypted tasking parameter
This rule detects network traffic patterns associated with BlueNoroff ClickFix C2 communications. It specifically identifies GET requests to endpoints containing an 'ft?id=' parameter followed by a base64-encoded string, which indicates the delivery of encrypted tasking parameters to an infected system.
Suricata
