DoH Beaconing to Resolve Amatera/EtherHiding C2 gw.proxyvector.cc

Ankit Mehta@Secvyn

•updated Sep 7, 2026•3•0•2

This rule identifies potential command and control (C2) activity by correlating DNS over HTTPS (DoH) requests initiated by non-browser or unsigned processes with subsequent network connections to a known malicious C2 domain (gw.proxyvector.cc) within a 15-minute window.