Proxy Traffic to Suspect C2 Domains Matching Operation Triangulation Beaconing Indicators

title: Proxy Traffic to Suspect C2 Domains Matching Operation Triangulation Beaconing Indicators
id: 7bd16814-ee5c-405a-abca-81fec514abb4
related:
  - id: 7fc30d63-728d-48d9-ad6f-14d14f4accf7
    type: similar
  - id: aa03c712-75c6-438b-8d42-de88f2427e09
    type: derived
status: test
description: This rule flags proxy requests whose host contains one of several hard-coded domains associated with potential C2 beaconing activity. Attackers may use periodic outbound connections to maintain command-and-control reachability and tasking. It relies on proxy logs providing the requested host (cs-host) values that can be matched for these domain substrings.
references:
  - https://securelist.com/operation-triangulation/109842/
  - https://www-fsb-ru.translate.goog/fsb/press/message/single.htm!id=10439739@fsbMessage.html?_x_tr_sch=http&_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=de&_x_tr_pto=wapp
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/EquationGroup/proxy_apt_equation_group_triangulation_c2_coms.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2023-06-01
tags:
  - attack.command-and-control
  - attack.g0020
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    cs-host|contains:
      - addatamarket.net
      - ans7tv.net
      - anstv.net
      - backuprabbit.com
      - businessvideonews.com
      - cloudsponcer.com
      - datamarketplace.net
      - growthtransport.com
      - mobilegamerstats.com
      - snoweeanalytics.com
      - tagclick-cdn.com
      - topographyupdates.com
      - unlimitedteacup.com
      - virtuallaughing.com
      - web-trackers.com
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1