Proxy Web Requests Matching Devil Bait C2 HTTP Parameters
Identifies proxy HTTP GET requests to /cross.php containing op, dt, and uid query parameters consistent with potential C2 traffic.
FreeReviewedSigma · High · v3
- Category
- proxy
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-15
- Updated
- 2026-07-31
What it detects
This rule identifies HTTP GET requests routed through a proxy that contain specific URI query parameters consistent with Devil Bait C2 communication attempts. Such patterned web traffic can indicate command-and-control behavior where an implant retrieves or exchanges data via crafted endpoints. Detection relies on proxy telemetry capturing the HTTP method and the requested URI path/query string.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-31
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
proxy-http-get-requests-to-cross-php-with-op-dt-and-uid-parameters-514c50c9
title: Proxy Web Requests Matching Devil Bait C2 HTTP Parameters
id: e52cdcc7-46bf-48db-a76a-c1b0104b74f8
status: test
description: This rule identifies HTTP GET requests routed through a proxy that contain specific URI query parameters consistent with Devil Bait C2 communication attempts. Such patterned web traffic can indicate command-and-control behavior where an implant retrieves or exchanges data via crafted endpoints. Detection relies on proxy telemetry capturing the HTTP method and the requested URI path/query string.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Devil-Bait/proxy_malware_devil_bait_c2_communication.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
modified: 2023-08-23
tags:
- attack.command-and-control
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
cs-method: GET
cs-uri|contains|all:
- /cross.php?op=
- "&dt="
- "&uid="
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 514c50c9-373a-46e5-9012-f0327c526c8f
type: derived