APT24 BADAUDIO C2 Communication via Cloudflare Workers
This rule detects command and control (C2) communication patterns associated with the BADAUDIO malware. Specifically, it looks for HTTP GET requests to known BADAUDIO C2 domains or Cloudflare Workers infrastructure. The detection logic focuses on the presence of specific cookie patterns ('Cookie: SSID=' or 'Cookie: cfuvid=') within the DestinationUrl, which BADAUDIO uses to exfiltrate encrypted system information. It also includes a specific URL path '/pub/static/img/merged' which might be used by the malware.
Sigma
