Periodic beaconing POSTs to LLM chat-completion APIs (possible C2 cover channel)

Ankit Mehta@Secvyn

•updated 28 days ago•0•0•2

This rule detects potential command and control (C2) beaconing activity by monitoring for high-frequency POST requests to OpenAI and Google Generative Language chat completion API endpoints. The rule triggers when a source host makes 5 or more requests within a 60-second window, which may indicate automated polling for commands or exfiltrated data transfer using legitimate LLM infrastructure.