ComRAT Proxy HTTP Requesting index.php with h Parameter
Flags proxy HTTP requests with URIs containing /index/index.php?h=, consistent with web-based C2 behavior.
- Category
- proxy
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2020-05-26
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies suspicious proxy web traffic with a URL path matching /index/index.php?h=. Such requests can indicate command-and-control style communications where an attacker embeds tasking or parameters in HTTP query strings. Detection relies on proxy telemetry that records the requested URI and flags when it contains the specified substring. The match is a narrow indicator of activity consistent with ComRAT network communication as described by the rule source.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: ComRAT Proxy HTTP Requesting index.php with h Parameter
id: 4b36a2e8-6633-4682-9334-00f2d6c0ac5e
status: test
description: This rule identifies suspicious proxy web traffic with a URL path matching /index/index.php?h=. Such requests can indicate command-and-control style communications where an attacker embeds tasking or parameters in HTTP query strings. Detection relies on proxy telemetry that records the requested URI and flags when it contains the specified substring. The match is a narrow indicator of activity consistent with ComRAT network communication as described by the rule source.
references:
- https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Malware/ComRAT/proxy_malware_comrat_network_indicators.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-05-26
modified: 2024-02-26
tags:
- attack.command-and-control
- attack.t1071.001
- attack.g0010
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
c-uri|contains: /index/index.php\?h=
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 7857f021-007f-4928-8b2c-7aedbe64bb82
type: derived