Firewall Alerts for C2 IP Traffic to 69.42.98.86 and 89.185.234.145

Alerts when firewall traffic involves the two specified IPs associated with presumed C2 communication.

FreeReviewedSigma · High · v5

Category: firewall
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2017-04-15
Updated: 2026-07-31

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1041Exfiltration Over C2 Channel
Impact

What it detects

This rule flags firewall events where either source or destination IP matches 69.42.98.86 or 89.185.234.145, which are listed as C2 endpoints in the provided operational notes. Monitoring this traffic matters because direct network connections to known C2 infrastructure can indicate command-and-control activity. It relies on firewall telemetry that records source and destination IP addresses for inbound or outbound sessions.

Reporting behind it

Related detections9 linkedT1041 — drag to rearrange

Suspicious DNS Exfiltration to azurestaticprovider Backdoor Domain

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious Vice Society Directory Crawling Script for Data Exfiltration - Via Ps_script (via ps_script)

Malicious PowerShell Exfiltration to webhook.site Following WSUS Exploitation

Suspicious InvisibleFerret C2 Endpoints over Port 1224 (via proxy)

Suspicious CurKeep Backdoor C2 API Endpoints (via proxy)

Suspicious DEEPPOST Data Exfiltration URI Pattern via BrazenBamboo

Suspicious Error 524 Decoy Smishing Phishing Endpoint Access (via proxy)

Suspicious COOKIE SPIDER macOS Data Exfiltration via curl Archive Upload (via process_creation)

Firewall Alerts for C2 IP Traffic to 69.42.98.86 and 89.185.234.145

Pivot detection · T1041 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

firewall-alerts-for-equation-group-c2-ip-communications-881834a4

title: Firewall Alerts for C2 IP Traffic to 69.42.98.86 and 89.185.234.145
id: 54ca1b9d-3426-4f49-88ab-221a6b693f56
status: test
description: This rule flags firewall events where either source or destination IP matches 69.42.98.86 or 89.185.234.145, which are listed as C2 endpoints in the provided operational notes. Monitoring this traffic matters because direct network connections to known C2 infrastructure can indicate command-and-control activity. It relies on firewall telemetry that records source and destination IP addresses for inbound or outbound sessions.
references:
  - https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
  - https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/TA/Equation-Group/net_firewall_apt_equationgroup_c2.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-04-15
modified: 2021-11-27
tags:
  - attack.exfiltration
  - attack.command-and-control
  - attack.g0020
  - attack.t1041
  - detection.emerging-threats
logsource:
  category: firewall
detection:
  selection:
    - dst_ip:
        - 69.42.98.86
        - 89.185.234.145
    - src_ip:
        - 69.42.98.86
        - 89.185.234.145
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 881834a4-6659-4773-821e-1c151789d873
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL