HarborWatch Agent C2 Endpoints Detection

Ethan Andrews@eandrews

•updated Jun 8, 2026•3•0•13

Detects network connections to specific API endpoints used by the HarborWatch Agent for Command and Control (C2) communication. This rule helps identify active C2 beaconing and tasking, even if the underlying IP infrastructure changes, by monitoring for unique URI paths like '/api/agent/tasks/' and '/api/heartbeat'.