Proxy Web Requests to static.tcplog.com Using Chrome-like User-Agent for Possible C2

title: Proxy Web Requests to static.tcplog.com Using Chrome-like User-Agent for Possible C2
id: cca8c6b9-9370-4087-a4a5-0f1725ce4827
status: test
description: This rule flags proxy log events where the HTTP request uses a specific Chrome/Windows-style User-Agent string and targets static.tcplog.com. Such traffic can indicate attempted command-and-control communication, especially when consistent with malware-driven HTTP beacons. The detection relies on proxy telemetry fields for the client User-Agent and the requested host.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Goofy-Guineapig/proxy_malware_goofy_gunieapig_c2_communication.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-14
tags:
  - attack.command-and-control
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    c-useragent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36
    cs-host: static.tcplog.com
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 4f573bb6-701a-4b8d-91db-87ae106e9a61
    type: derived