Empire C2 Proxy Requests with Specific User-Agent and POSTed PHP URIs

Flags proxy HTTP POSTs using an Empire-like user agent to specific admin/login PHP endpoints.

FreeReviewedSigma · High · v2

Category: proxy
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2020-07-13
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
Impact

What it detects

This rule flags proxy traffic where a specific Empire-like Windows user agent is combined with POST requests to a defined set of PHP endpoints (/admin/get.php, /news.php, /login/process.php). Attackers using Empire can blend command-and-control traffic into normal web requests by using recognizable URI patterns and consistent client fingerprints. Detection relies on proxy logs that capture HTTP method, the full request URI path, and the user-agent header.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Malicious HTTP User Agent zzhbot From Docker API Compromise

Malicious Encrypted Reverse Shell via Netcat and GPG on Linux

Malicious axios NPM Supply Chain C2 Domain Resolution

Suspicious Reverse Shell via Dev TCP or Netcat

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious BadIIS C2 Communication via lwxatisme User-Agent

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

Suspicious WarmCookie C2 Beacon With Fixed Firefox User-Agent

Empire C2 Proxy Requests with Specific User-Agent and POSTed PHP URIs

Pivot detection · T1071.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

proxy-detects-empire-style-user-agent-with-post-to-common-php-admin-auth-paths-b923f7d6

title: Empire C2 Proxy Requests with Specific User-Agent and POSTed PHP URIs
id: 695886c9-281d-41b0-a8c7-7afbf25747b1
status: test
description: This rule flags proxy traffic where a specific Empire-like Windows user agent is combined with POST requests to a defined set of PHP endpoints (/admin/get.php, /news.php, /login/process.php). Attackers using Empire can blend command-and-control traffic into normal web requests by using recognizable URI patterns and consistent client fingerprints. Detection relies on proxy logs that capture HTTP method, the full request URI path, and the user-agent header.
references:
  - https://github.com/BC-SECURITY/Empire
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_hktl_empire_ua_uri_patterns.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-07-13
modified: 2024-02-26
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection:
    c-useragent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    cs-uri:
      - /admin/get.php
      - /news.php
      - /login/process.php
    cs-method: POST
  condition: selection
falsepositives:
  - Valid requests with this exact user agent to server scripts of the defined names
level: high
license: DRL-1.1
related:
  - id: b923f7d6-ac89-4a50-a71a-89fb846b4aa8
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL