LegionLoader HTTP POST C2 to /nfront.php or /nback.php (Satacom/CurlyGate)
Detects LegionLoader (Satacom/CurlyGate) malware communicating with command and control servers via HTTP POST requests to /nfront.php or /nback.php, or via form-urlencoded POST requests originating from non-browser executables using WinHTTP.
YARA-L
