TrickBot HTTP(S) C2 POST Beacon to Module/Exfil Endpoints

Ankit Mehta@Secvyn

•updated 7 days ago•0•0•0

Detects HTTP POST requests characteristic of TrickBot C2 beaconing. The rule identifies specific URI structures, Content-Type headers set to 'application/octet-stream', and unique request body behaviors that are indicative of TrickBot communication patterns.