Proxy HTTP GET to /api/Core/Command Init/Restart indicative of possible C2
Flags proxy HTTP GET requests to C2-like command initialization/restart endpoints based on URI suffixes.
FreeReviewedSigma · Medium · v5
- Category
- proxy
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-01-15
- Updated
- 2026-07-31
What it detects
This rule flags proxy-observed HTTP GET requests whose request URI ends with /api/Core/Command/Init or /api/Core/Command/Restart. Such endpoint-specific polling or command initialization/restart behavior can indicate command-and-control or remote tasking. Detection relies on proxy telemetry capturing HTTP method and full request URI.
Reporting behind it
- twitter.comhttps://twitter.com/MsftSecIntel/status/1737895710169628824
- virustotal.comhttps://www.virustotal.com/gui/file/364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614/details
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Peach-Sandstorm/proxy_apt_peach_sandstorm_falsefont_backdoor_c2_coms.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
proxy-log-detection-of-get-requests-to-api-core-command-init-restart-paths-b8225208
title: Proxy HTTP GET to /api/Core/Command Init/Restart indicative of possible C2
id: 083136a3-1776-41e0-92d8-c6823643ae7c
status: test
description: This rule flags proxy-observed HTTP GET requests whose request URI ends with /api/Core/Command/Init or /api/Core/Command/Restart. Such endpoint-specific polling or command initialization/restart behavior can indicate command-and-control or remote tasking. Detection relies on proxy telemetry capturing HTTP method and full request URI.
references:
- https://twitter.com/MsftSecIntel/status/1737895710169628824
- https://www.virustotal.com/gui/file/364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614/details
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Peach-Sandstorm/proxy_apt_peach_sandstorm_falsefont_backdoor_c2_coms.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2024-01-15
tags:
- attack.command-and-control
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
cs-method: GET
c-uri|endswith:
- /api/Core/Command/Init
- /api/Core/Command/Restart
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: b8225208-81d0-4715-a822-12bcdd583e0f
type: derived