Chafer malware C2 URLs with /asp.asp?ui= pattern over HTTP proxy
Flags proxy HTTP requests containing the C2 URI pattern /asp.asp?ui= associated with Chafer behavior.
FreeReviewedSigma · High · v5
- Category
- proxy
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-01-31
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule matches HTTP proxy requests whose URL path contains /asp.asp?ui=. Such a pattern is used to receive data from command-and-control infrastructure, making it a high-signal indicator for suspicious outbound communications. It relies on proxy telemetry that includes the full requested URI (c-uri) for each HTTP request.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
chafer-malware-c2-http-requests-matching-asp-asp-ui-pattern-fb502828
title: Chafer malware C2 URLs with /asp.asp?ui= pattern over HTTP proxy
id: 249207b2-3d50-4850-b41d-b4b9d6307ac9
status: test
description: This rule matches HTTP proxy requests whose URL path contains /asp.asp?ui=. Such a pattern is used to receive data from command-and-control infrastructure, making it a high-signal indicator for suspicious outbound communications. It relies on proxy telemetry that includes the full requested URI (c-uri) for each HTTP request.
references:
- https://securelist.com/chafer-used-remexi-malware/89538/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Chafer/proxy_malware_chafer_url_pattern.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-01-31
modified: 2024-02-15
tags:
- attack.command-and-control
- attack.t1071.001
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
c-uri|contains: /asp.asp\?ui=
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: fb502828-2db0-438e-93e6-801c7548686d
type: derived