Casbaneiro: C2 Malformed HTTP GET /$p Beacon

Arnold Chan@slaz

•updated 22 days ago•0•0•2

Detects specific malformed HTTP request patterns associated with the Casbaneiro (Metamorfo) banking trojan. The rules identify suspicious beaconing attempts, including specific URI structures ('/$p', '/$or?u=') and malformed headers (missing Host header combined with specific Content-Length anomalies).