Corp MDM Android spyware C2 command polling detected

Arnold Chan@slaz

•updated Sep 25, 2026•0•0•0

Detects outbound HTTP requests from endpoints to a known C2 infrastructure associated with mobile device spyware. The rule identifies two specific stages: polling for new commands using a GET request and posting command execution results using a POST request, both targeting an MDM-mimicking API structure.