UNC6692 Edgecution/SNOWBELT WebSocket C2 - HTTP Upgrade to known CloudFront C2 subdomain via /ws path
Detects HTTP GET requests with an Upgrade: websocket header directed at known UNC6692 Edgecution/SNOWBELT malware command-and-control infrastructure hosted on CloudFront subdomains via the /ws URI path. This indicates active WebSocket-based communication between an infected host and the threat actor's C2 server.
Suricata
