Chafer Malware C2 HTTP Requests Matching /asp.asp?ui= Pattern

Flags proxy HTTP requests containing the C2 URI pattern /asp.asp?ui= associated with Chafer behavior.

FreeUnreviewedSigmahighv1

chafer-malware-c2-http-requests-matching-asp-asp-ui-pattern-fb502828

title: Chafer Malware C2 HTTP Requests Matching /asp.asp?ui= Pattern
id: 249207b2-3d50-4850-b41d-b4b9d6307ac9
status: test
description: This rule identifies HTTP proxy requests whose requested URI contains the specific path and query pattern /asp.asp?ui=. Such traffic can indicate malware attempting to retrieve or exchange data with a command-and-control endpoint. The detection relies on URI content observed in proxy logs, matching the exact substring used by the suspected C2 interaction.
references:
  - https://securelist.com/chafer-used-remexi-malware/89538/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Chafer/proxy_malware_chafer_url_pattern.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-01-31
modified: 2024-02-15
tags:
  - attack.command-and-control
  - attack.t1071.001
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains: /asp.asp\?ui=
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: fb502828-2db0-438e-93e6-801c7548686d
    type: derived

What it detects

This rule identifies HTTP proxy requests whose requested URI contains the specific path and query pattern /asp.asp?ui=. Such traffic can indicate malware attempting to retrieve or exchange data with a command-and-control endpoint. The detection relies on URI content observed in proxy logs, matching the exact substring used by the suspected C2 interaction.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.