BabyShark C2 Default URI Pattern Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•26

Detects the default communication pattern used by the BabyShark C2 framework, specifically looking for the 'momyshark?key=' string within the URI of proxy requests. This pattern is indicative of BabyShark malware attempting to communicate with its command and control server.