Emotet HTTP C2 Beacon: Random-Path POST with Binary Body

Ankit Mehta@Secvyn

•updated 29 days ago•0•0•1

Detects outbound HTTP POST requests characteristic of Emotet malware command-and-control beaconing. The rule identifies communication to an external network using a specific URI pattern (4-16 alphanumeric characters), a 'Content-Type: application/octet-stream' header, and a legacy Internet Explorer 7.0 User-Agent, while explicitly excluding common non-binary or HTML response formats in the request body.