Proxy HTTP GET Requests to /cross.php with op, dt, and uid Parameters

Identifies proxy HTTP GET requests to /cross.php containing op, dt, and uid query parameters consistent with potential C2 traffic.

FreeUnreviewedSigmahighv1

proxy-http-get-requests-to-cross-php-with-op-dt-and-uid-parameters-514c50c9

title: Proxy HTTP GET Requests to /cross.php with op, dt, and uid Parameters
id: e52cdcc7-46bf-48db-a76a-c1b0104b74f8
status: test
description: This rule flags proxy traffic containing HTTP GET requests for paths under /cross.php with specific query parameters (op, dt, and uid). Such patterned URI construction can indicate attempt(s) to exchange data with command-and-control infrastructure disguised as application traffic. It relies on proxy logs capturing the HTTP method and the full request URI so the parameter presence and ordering in the URI can be evaluated.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Devil-Bait/proxy_malware_devil_bait_c2_communication.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
modified: 2023-08-23
tags:
  - attack.command-and-control
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    cs-method: GET
    cs-uri|contains|all:
      - /cross.php?op=
      - "&dt="
      - "&uid="
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 514c50c9-373a-46e5-9012-f0327c526c8f
    type: derived

What it detects

This rule flags proxy traffic containing HTTP GET requests for paths under /cross.php with specific query parameters (op, dt, and uid). Such patterned URI construction can indicate attempt(s) to exchange data with command-and-control infrastructure disguised as application traffic. It relies on proxy logs capturing the HTTP method and the full request URI so the parameter presence and ordering in the URI can be evaluated.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.