Emotet Epoch 4/5 C2 HTTP POST Fake Cookie Base64 Payload

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects HTTP POST requests characteristic of Emotet Epoch 4 and 5 C2 communication. The rule monitors for specific URI patterns, the presence of a 'Cookie' header, and a base64-encoded request body exceeding 80 characters, which are indicative of Emotet malware beaconing activity.