GapiUpdate stager authenticated GET to gapidriver.com config endpoint

Arnold Chan@slaz

•updated Sep 15, 2026•0•0•1

Detects HTTP traffic from internal hosts to the 'gapidriver.com' domain, specifically identifying the GapiUpdate stager behavior. The rule looks for authenticated GET requests to '/api/get.php' using a specific Bearer token and User-Agent, as well as status reporting to '/api/rest.php'.