Proxy Log Detection of GET Requests to /api/Core/Command Init/Restart Paths

Flags proxy HTTP GET requests to C2-like command initialization/restart endpoints based on URI suffixes.

FreeUnreviewedSigmamediumv1

proxy-log-detection-of-get-requests-to-api-core-command-init-restart-paths-b8225208

title: Proxy Log Detection of GET Requests to /api/Core/Command Init/Restart Paths
id: 083136a3-1776-41e0-92d8-c6823643ae7c
status: test
description: This rule identifies proxy HTTP traffic containing GET requests whose URI ends with /api/Core/Command/Init or /api/Core/Command/Restart. Such request patterns can indicate initialization or restart behavior for remote command functionality, which is relevant to adversary command-and-control workflows. The detection relies on proxy logs capturing the HTTP method and request URI.
references:
  - https://twitter.com/MsftSecIntel/status/1737895710169628824
  - https://www.virustotal.com/gui/file/364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614/details
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Peach-Sandstorm/proxy_apt_peach_sandstorm_falsefont_backdoor_c2_coms.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2024-01-15
tags:
  - attack.command-and-control
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    cs-method: GET
    c-uri|endswith:
      - /api/Core/Command/Init
      - /api/Core/Command/Restart
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: b8225208-81d0-4715-a822-12bcdd583e0f
    type: derived

What it detects

This rule identifies proxy HTTP traffic containing GET requests whose URI ends with /api/Core/Command/Init or /api/Core/Command/Restart. Such request patterns can indicate initialization or restart behavior for remote command functionality, which is relevant to adversary command-and-control workflows. The detection relies on proxy logs capturing the HTTP method and request URI.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.