THL DETECT AdaptixC2 Beacon Empty-Body POST Carrying X-Beacon-Id Header (Framework C2 Heartbeat)
Sourcehunters-ledger
Filehunters-ledger.rules
CreatedAugust 13, 2026
UpdatedSeptember 11, 2026
Classificationtrojan-activity
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"THL DETECT AdaptixC2 Beacon Empty-Body POST Carrying X-Beacon-Id Header (Framework C2 Heartbeat)"; flow:established,to_server ; http.method; content:"POST"; http.header_names; content:"X-Beacon-Id"; nocase; http.header; content:"Content-Length|3a| 0|0d 0a|"; threshold:type limit,track by_src,count 1,seconds 3600 ; classtype:trojan-activity; sid:3500185; rev:1; metadata:author The_Hunters_Ledger, date 2026-08-12, reference https://the-hunters-ledger.com/hunting-detections/opendirectory-45-130-148-125-20260430-detections/ ;)
Metadata
authorThe_Hunters_Ledger
date2026-08-12
referencehttps://the-hunters-ledger.com/hunting-detections/opendirectory-45-130-148-125-20260430-detections/
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!