Ursnif C2 Proxy Traffic Identified by Base64 URI Encoding and .avi/.images Pattern

Flags proxy requests with Base64-like URI characters plus '/images/' and '.avi' patterns consistent with Ursnif C2.

FreeReviewedSigma · Critical · v5

Category: proxy
Author: Thomas Patzke (SigmaHQ), DRL 1.1
Published: 2019-12-19
Updated: 2026-07-31

ATT&CK techniques

Initial Access → C2

Recon
Resource Dev
Initial Access
- T1566.001Spearphishing Attachment
Execution
- T1204.002Malicious File
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
Impact

What it detects

This rule flags proxy requests whose URI appears to include Base64-encoded content and simultaneously matches an expected path and file pattern: the URI contains '.avi' and '/images/'. Such C2-looking web traffic matters because malware commonly disguises or transforms communications in outbound URLs to blend with normal traffic and hinder inspection. The detection relies on proxy telemetry, inspecting the request URI for specific substrings indicative of encoding and the targeted '.avi' plus '/images/' structure.

Reporting behind it

Related detections9 linkedT1204.002 — drag to rearrange

Suspicious DLL Written to Explorer IconCache Path

Windows process creation: Winword launching FLTLDR.exe exploitation behavior

Windows Process Creation: EQNEDT32.EXE Used as CVE-2017-11882 Exploit Dropper Parent

Windows: Winword spawning csc.exe indicative of CVE-2017-8759 exploitation

Malicious axios NPM Supply Chain C2 Domain Resolution

Suspicious OneNote Spawning Script Interpreter (via process_creation)

Suspicious vbc.exe Spawned by Installer Process

Suspicious Reverse Shell via Dev TCP or Netcat

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

Ursnif C2 Proxy Traffic Identified by Base64 URI Encoding and .avi/.images Pattern

Pivot detection · T1204.002 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

ursnif-c2-traffic-via-proxy-url-base64-encoded-path-with-avi-image-pattern-932ac737

title: Ursnif C2 Proxy Traffic Identified by Base64 URI Encoding and .avi/.images Pattern
id: f0263e82-e5f0-4600-b653-dadfcdd277a1
status: stable
description: "This rule flags proxy requests whose URI appears to include Base64-encoded content and simultaneously matches an expected path and file pattern: the URI contains '.avi' and '/images/'. Such C2-looking web traffic matters because malware commonly disguises or transforms communications in outbound URLs to blend with normal traffic and hinder inspection. The detection relies on proxy telemetry, inspecting the request URI for specific substrings indicative of encoding and the targeted '.avi' plus '/images/' structure."
references:
  - https://www.fortinet.com/blog/threat-research/ursnif-variant-spreading-word-document.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Ursnif/proxy_malware_ursnif_c2_url.yml
author: Thomas Patzke, Huntrule Team
date: 2019-12-19
modified: 2021-08-09
tags:
  - attack.initial-access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.command-and-control
  - attack.t1071.001
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  b64encoding:
    c-uri|contains:
      - _2f
      - _2b
  urlpatterns:
    c-uri|contains|all:
      - .avi
      - /images/
  condition: b64encoding and urlpatterns
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 932ac737-33ca-4afd-9869-0d48b391fcc9
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL