Turla ComRAT Proxy HTTP Requests to index.php?h=

Flags proxy HTTP requests with URIs containing /index/index.php?h=, consistent with web-based C2 behavior.

FreeUnreviewedSigmahighv1

turla-comrat-proxy-http-requests-to-index-php-h-7857f021

title: Turla ComRAT Proxy HTTP Requests to index.php?h=
id: 4b36a2e8-6633-4682-9334-00f2d6c0ac5e
status: test
description: This rule matches proxy logs for HTTP requests whose URI contains '/index/index.php?h='. Such traffic can indicate command-and-control style web communication used by malware to exchange data with an external server. It relies on proxy telemetry capturing the full request URI, specifically the queried path pattern.
references:
  - https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Malware/ComRAT/proxy_malware_comrat_network_indicators.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-05-26
modified: 2024-02-26
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.g0010
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains: /index/index.php\?h=
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7857f021-007f-4928-8b2c-7aedbe64bb82
    type: derived

What it detects

This rule matches proxy logs for HTTP requests whose URI contains '/index/index.php?h='. Such traffic can indicate command-and-control style web communication used by malware to exchange data with an external server. It relies on proxy telemetry capturing the full request URI, specifically the queried path pattern.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.