KREMLIN payload-tasking HTTP request pattern (prefix=NF, output=base64)

Ankit Mehta@Secvyn

•updated Sep 16, 2026•0•0•1

This rule monitors network connections and HTTP requests for specific URL patterns that include encoded (base64) parameters and indicators often associated with command and control or data exfiltration. It detects endpoints accessing URLs containing a prefix sequence of 10 characters and specific endpoints like '/generate' or '/kremlin'.