Potential C2 HTTP Traffic via Goofy Guineapig User-Agent to static.tcplog.com (Proxy Logs)
Flags proxy HTTP requests with a specific Chrome-like User-Agent to static.tcplog.com, consistent with potential C2 traffic.
FreeReviewedSigma · High · v5
- Category
- proxy
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-14
- Updated
- 2026-07-31
What it detects
This rule flags proxy web requests whose client User-Agent matches a specific Chrome/Windows string associated with the Goofy Guineapig backdoor activity and that target static.tcplog.com. Such traffic may represent outbound command-and-control attempts masquerading as normal browser activity. Detection relies on proxy telemetry that records the HTTP User-Agent and the destination host for each request.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
proxy-web-requests-to-static-tcplog-com-using-chrome-like-user-agent-for-possibl-4f573bb6
title: Potential C2 HTTP Traffic via Goofy Guineapig User-Agent to static.tcplog.com (Proxy Logs)
id: cca8c6b9-9370-4087-a4a5-0f1725ce4827
status: test
description: This rule flags proxy web requests whose client User-Agent matches a specific Chrome/Windows string associated with the Goofy Guineapig backdoor activity and that target static.tcplog.com. Such traffic may represent outbound command-and-control attempts masquerading as normal browser activity. Detection relies on proxy telemetry that records the HTTP User-Agent and the destination host for each request.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Goofy-Guineapig/proxy_malware_goofy_gunieapig_c2_communication.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-14
tags:
- attack.command-and-control
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
c-useragent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36
cs-host: static.tcplog.com
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 4f573bb6-701a-4b8d-91db-87ae106e9a61
type: derived