Emotet HTTP C2 POST with Random Alphanumeric URI Path

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects outbound HTTP POST requests characterized by a specific URL pattern consisting of two segments of 4-16 alphanumeric characters, typically observed in Emotet C2 traffic. The rule specifically matches requests with a Content-Type header set to application/octet-stream, which is indicative of malicious binary payload transfer or communication.