Amatera Stealer C2 Beacon - POST /T.@w GetEndpoints

Arnold Chan@slaz

•updated Sep 10, 2026•0•0•2

Detects specific outbound HTTP POST requests to a known Amatera Stealer command and control domain. The rule looks for the unique URI path '/T.@w' and a specific 'Command: GetEndpoints' header structure commonly used by this malware family to beacon to its C2 infrastructure.