AdaptixC2 HTTP beacon check-in - X-Beacon-Id header with known URI path

Duo Tech@duotech

•updated Jul 27, 2026•1•0•2

This rule detects potential command and control (C2) beaconing activity associated with the AdaptixC2 framework. It identifies HTTP requests containing a specific 'X-Beacon-Id' header combined with known C2 URI patterns and a specific User-Agent string commonly observed in AdaptixC2 traffic.