Proxy Traffic to Operation Triangulation Domains Indicative of C2 Beaconing
Alerts on proxy requests to specific suspect C2-related domains by host substring match.
FreeReviewedSigma · High · v5
- Category
- proxy
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-01
- Updated
- 2026-07-31
What it detects
This rule flags proxy requests whose destination host contains any of several domains associated with Operation Triangulation activity. Such domain-based traffic can indicate periodic beaconing to command-and-control infrastructure. It relies on proxy telemetry that includes the requested destination hostname for matching against the specified domain substrings.
Reporting behind it
- securelist.comhttps://securelist.com/operation-triangulation/109842/
- www-fsb-ru.translate.googhttps://www-fsb-ru.translate.goog/fsb/press/message/single.htm!id=10439739@fsbMessage.html?_x_tr_sch=http&_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=de&_x_tr_pto=wapp
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/EquationGroup/proxy_apt_equation_group_triangulation_c2_coms.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
proxy-traffic-to-suspect-c2-domains-matching-operation-triangulation-beaconing-i-aa03c712
title: Proxy Traffic to Operation Triangulation Domains Indicative of C2 Beaconing
id: 7bd16814-ee5c-405a-abca-81fec514abb4
related:
- id: 7fc30d63-728d-48d9-ad6f-14d14f4accf7
type: similar
- id: aa03c712-75c6-438b-8d42-de88f2427e09
type: derived
status: test
description: This rule flags proxy requests whose destination host contains any of several domains associated with Operation Triangulation activity. Such domain-based traffic can indicate periodic beaconing to command-and-control infrastructure. It relies on proxy telemetry that includes the requested destination hostname for matching against the specified domain substrings.
references:
- https://securelist.com/operation-triangulation/109842/
- https://www-fsb-ru.translate.goog/fsb/press/message/single.htm!id=10439739@fsbMessage.html?_x_tr_sch=http&_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=de&_x_tr_pto=wapp
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/EquationGroup/proxy_apt_equation_group_triangulation_c2_coms.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2023-06-01
tags:
- attack.command-and-control
- attack.g0020
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
cs-host|contains:
- addatamarket.net
- ans7tv.net
- anstv.net
- backuprabbit.com
- businessvideonews.com
- cloudsponcer.com
- datamarketplace.net
- growthtransport.com
- mobilegamerstats.com
- snoweeanalytics.com
- tagclick-cdn.com
- topographyupdates.com
- unlimitedteacup.com
- virtuallaughing.com
- web-trackers.com
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1