Custom Armored Binary Protocol HTTP POST C2 Beacon (StealC-style)

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•0

This rule monitors HTTP POST requests for patterns indicative of armored malware (specifically StealC) beaconing to a Command and Control (C2) server. The rule looks for established connections that use POST requests while avoiding common patterns found in standard web traffic (like JSON, XML, or standard form data) and having a specific request body size threshold. The thresholding mechanism helps reduce noise by only alerting when multiple occurrences are observed within a short time frame, suggesting automated beaconing behavior.