Evasive Panda SohuVA Lure URL Detection
This rule detects network traffic indicative of the Evasive Panda APT's use of a specific SohuVA lure. It looks for connections to 'p2p.hd.sohu.com' with the path '/foxd/gz' combined with specific query parameters such as 'sohunewplayer', 'new=/66/157/', or 'ovztb0wktdmakeszwh2eha'. The detection logic applies to both 'c-uri' and 'RequestUrl' fields, suggesting it targets proxy or web traffic logs. The rule aims for high fidelity by combining these specific URL components and parameters, differentiating it from generic Sohu update traffic.
Sigma
