Detectioncriticaltest

HackTool - BabyShark Agent Default URL Pattern

Detects Baby Shark C2 Framework default communication patterns

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems)Created Wed Jun 09Updated Thu Feb 15304810ed-8853-437f-9e36-c4975c3dfd7eweb

Log Source

Proxy Log

CategoryProxy Log← raw: proxy

Detection Logic

detection:
    selection:
        c-uri|contains: 'momyshark\?key='
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

304810ed-8853-437f-9e36-c4975c3dfd7e

Status

test

Level

critical

Type

Detection

Created

Wed Jun 09

Modified

Thu Feb 15

Author

Path

rules/web/proxy_generic/proxy_hktl_baby_shark_default_agent_url.yml

Raw Tags

attack.command-and-controlattack.t1071.001