Firewall Alerts for C2 IP Traffic to 69.42.98.86 and 89.185.234.145
Alerts when firewall traffic involves the two specified IPs associated with presumed C2 communication.
- Category
- firewall
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2017-04-15
- Updated
- 2026-07-31
ATT&CK techniques
ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags firewall events where either source or destination IP matches 69.42.98.86 or 89.185.234.145, which are listed as C2 endpoints in the provided operational notes. Monitoring this traffic matters because direct network connections to known C2 infrastructure can indicate command-and-control activity. It relies on firewall telemetry that records source and destination IP addresses for inbound or outbound sessions.
Reporting behind it
- steemit.comhttps://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
- medium.comhttps://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/TA/Equation-Group/net_firewall_apt_equationgroup_c2.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Firewall Alerts for C2 IP Traffic to 69.42.98.86 and 89.185.234.145
id: 54ca1b9d-3426-4f49-88ab-221a6b693f56
status: test
description: This rule flags firewall events where either source or destination IP matches 69.42.98.86 or 89.185.234.145, which are listed as C2 endpoints in the provided operational notes. Monitoring this traffic matters because direct network connections to known C2 infrastructure can indicate command-and-control activity. It relies on firewall telemetry that records source and destination IP addresses for inbound or outbound sessions.
references:
- https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
- https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/TA/Equation-Group/net_firewall_apt_equationgroup_c2.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-04-15
modified: 2021-11-27
tags:
- attack.exfiltration
- attack.command-and-control
- attack.g0020
- attack.t1041
- detection.emerging-threats
logsource:
category: firewall
detection:
selection:
- dst_ip:
- 69.42.98.86
- 89.185.234.145
- src_ip:
- 69.42.98.86
- 89.185.234.145
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 881834a4-6659-4773-821e-1c151789d873
type: derived