Bird Agent MQTT C2 Beaconing via HiveMQ Broker Infrastructure

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•3

This rule detects outbound network communications (TLS, MQTT, and HTTP) to HiveMQ infrastructure. The pattern of activity suggests the presence of 'Bird Agent' malware utilizing the MQTT protocol for command and control (C2) communication, as well as periodic HTTP beaconing to HiveMQ broker endpoints.