Empire C2 Proxy Requests with Specific User-Agent and POSTed PHP URIs

Flags proxy HTTP POSTs using an Empire-like user agent to specific admin/login PHP endpoints.

FreeReviewedSigma · High · v2

Category: proxy
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2020-07-13
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
Impact

What it detects

This rule flags proxy traffic where a specific Empire-like Windows user agent is combined with POST requests to a defined set of PHP endpoints (/admin/get.php, /news.php, /login/process.php). Attackers using Empire can blend command-and-control traffic into normal web requests by using recognizable URI patterns and consistent client fingerprints. Detection relies on proxy logs that capture HTTP method, the full request URI path, and the user-agent header.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Malicious Interlock RAT FileFix Download-Cradle via PowerShell WebClient with PowerShell User-Agent (via ps_script)

Suspicious Cobalt Strike Malleable Profile Beaconing via Legacy MSIE9 User-Agent and IE Compatibility URIs (via proxy)

Malicious Cobalt Strike Default Named Pipe Activity

Malicious VoidLink Kernel Rootkit C2 Endpoints via HTTP (via proxy)

Malicious EtherRAT C2 Exfiltration Endpoints via HTTP (via proxy)

Possible PlugX and NPS Proxy Command and Control Domain Lookup

Possible Backdoor Mistic Command and Control Domain Lookup

Suspicious Weaver Ant In-Memory Web Shell Marker in Web Request (via webserver)

Malicious BlueNoroff C2 Communication via cur1-agent User-Agent (via proxy)

Empire C2 Proxy Requests with Specific User-Agent and POSTed PHP URIs

Pivot detection · T1071.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

proxy-detects-empire-style-user-agent-with-post-to-common-php-admin-auth-paths-b923f7d6

title: Empire C2 Proxy Requests with Specific User-Agent and POSTed PHP URIs
id: 695886c9-281d-41b0-a8c7-7afbf25747b1
status: test
description: This rule flags proxy traffic where a specific Empire-like Windows user agent is combined with POST requests to a defined set of PHP endpoints (/admin/get.php, /news.php, /login/process.php). Attackers using Empire can blend command-and-control traffic into normal web requests by using recognizable URI patterns and consistent client fingerprints. Detection relies on proxy logs that capture HTTP method, the full request URI path, and the user-agent header.
references:
  - https://github.com/BC-SECURITY/Empire
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_hktl_empire_ua_uri_patterns.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-07-13
modified: 2024-02-26
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection:
    c-useragent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    cs-uri:
      - /admin/get.php
      - /news.php
      - /login/process.php
    cs-method: POST
  condition: selection
falsepositives:
  - Valid requests with this exact user agent to server scripts of the defined names
level: high
license: DRL-1.1
related:
  - id: b923f7d6-ac89-4a50-a71a-89fb846b4aa8
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL