Potential Peach Sandstorm APT C2 Communication

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•0•20

Detects potential Command and Control (C2) communication activity associated with the Peach Sandstorm APT group. The rule specifically looks for HTTP GET requests to '/api/Core/Command/Init' or '/api/Core/Command/Restart' endpoints, which are indicators of this group's C2 infrastructure.