All Detections

Custom Backdoor HTTP C2 Check-in to version/check.php with Spoofed Chrome UA

avatar
Duo Tech@duotech
updated Aug 17, 2026005

Detects HTTP POST tasking check-ins to /version/check.php using the backdoor's hardcoded, obsolete Chrome 78.0.3904.108 user-agent string.

Suricata