Emerging Threatmediumtest

Potential Peach Sandstorm APT C2 Communication Activity

Detects potential C2 communication activity related to Peach Sandstorm APT

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

X__Junior (Nextron Systems)Created Mon Jan 15b8225208-81d0-4715-a822-12bcdd583e0f2023

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Proxy Log

CategoryProxy Log← raw: proxy

Detection Logic

detection:
    selection:
        cs-method: 'GET'
        c-uri|endswith:
            - '/api/Core/Command/Init'
            - '/api/Core/Command/Restart'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0011 · Command and Control

Other

detection.emerging-threats

Rule Metadata

Rule ID

b8225208-81d0-4715-a822-12bcdd583e0f

Status

test

Level

medium

Type

Emerging Threat

Created

Mon Jan 15

Author

X__Junior (Nextron Systems)

Path

rules-emerging-threats/2023/TA/Peach-Sandstorm/proxy_apt_peach_sandstorm_falsefont_backdoor_c2_coms.yml

Raw Tags

attack.command-and-controldetection.emerging-threats

View on GitHub