RANSOMWARE enc_c2.exe Tor C2 Beacon - POST /c2/beacon.php - Suricata Rule 3500153 (hunters-ledger)

RANSOMWARE enc_c2.exe Tor C2 Beacon - POST /c2/beacon.php

SID: 3500153Rev: 2Enabled2 views

Filehunters-ledger.rules

CreatedJuly 16, 2026

UpdatedJuly 16, 2026

Classificationtrojan-activity

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"RANSOMWARE enc_c2.exe Tor C2 Beacon - POST /c2/beacon.php"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/c2/beacon.php"; http.header; content:"Content-Type: application/json"; classtype:trojan-activity; metadata:author The_Hunters_Ledger, date 2026-01-26, reference https://the-hunters-ledger.com/hunting-detections/arsenal-237-enc_c2-exe-detections/; sid:3500153; rev:2;)

Metadata

authorThe_Hunters_Ledger

date2026-01-26

referencehttps://the-hunters-ledger.com/hunting-detections/arsenal-237-enc_c2-exe-detections/

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!