THL - A2A C2 Beacon POST to Operator C2 Endpoint with X-Agent-ID Header
Sourcehunters-ledger
Filehunters-ledger.rules
CreatedApril 4, 2026
UpdatedJuly 13, 2026
Classificationtrojan-activity
alert http $HOME_NET any -> any any (msg:"THL - A2A C2 Beacon POST to Operator C2 Endpoint with X-Agent-ID Header"; flow:established,to_server ; http.method; content:"POST"; http.header_names; content:"X-Agent-ID"; nocase; http.uri; content:"/api/v1/"; pcre:"/\/api\/v1\/(update|interact|telemetry|get_results)/"; classtype:trojan-activity; sid:3500093; rev:2; metadata:author The_Hunters_Ledger, date 2026-05-25, reference https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/ ;)
Metadata
authorThe_Hunters_Ledger
date2026-05-25
referencehttps://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!