SilverFox relay discovery-to-dispatch TTP via timestamped relays.json/api.php

Arnold Chan@slaz

•updated 25 days ago•0•0•1

Detects a two-stage pattern indicative of command-and-control (C2) communication. The rule identifies an initial request to a 'relays.json' endpoint (relay discovery) followed by a request to an 'api.php' endpoint (dispatcher decision) within a 5-second window, both using a 13-digit timestamp query string for cache-busting. It also captures single-stage 'api.php' requests as lower confidence alerts.