PowerShell Empire Default HTTP(S) C2 Staging & Cookie Exchange

Ankit Mehta@Secvyn

•updated 7 days ago•0•0•0

Detects HTTP traffic patterns associated with the default staging URIs of the PowerShell Empire C2 framework. This rule identifies inbound requests to specific .php files (admin/get, news, login/process) with a 'session=' cookie, which are characteristic of Empire agent beaconing behavior.