huntrule

Suspicious Spoofed Microsoft Host Header C2 by Stately Taurus

PremiumReviewedSigma · Medium · v1
Category
proxy
Author
HuntRule
Published
2026-10-21
Updated
2026-10-21
AnalysisDetection

ATT&CK techniques

Defense Evasion → C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects outbound HTTP requests carrying a spoofed Host header of wcpstatic.microsoft.com toward destinations that are not Microsoft infrastructure, matching the command and control masquerading used by Stately Taurus per Unit 42. The actor forges a trusted Microsoft hostname to blend beacons with legitimate traffic which conceals its espionage channel.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange
Suspicious Cobalt Strike OCSP Malleable C2 Profile Traffic
Suspicious FalseFont Backdoor C2 Command Endpoint Requests (via proxy)
Suspicious Cobalt Strike Download Profile POST to pkg Path
Malicious Kazuar Backdoor C2 via Hardcoded HTTP Cookie by Pensive Ursa
Suspicious Mispadu Infostealer C2 Beacon URL Pattern (via proxy)
Suspicious Double Extension Image Executable by Fighting Ursa
Suspicious Outbound Connection to TuxBot Botnet C2 Ports
Suspicious MQTT Command and Control Connection by WikiLoader
Malicious Axios Supply Chain C2 Beacon Domain (via dns_query)
Suspicious Spoofed Microsoft Host Header C2 by Stately Taurus
Pivot detection · T1071.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.