possible_cc_traffic_from_malware_variants

rule possible_cc_traffic_from_malware_variants {
 meta:
    author = "Joseph Kamau"
    description = "This rule can be used to hunt for command and control traffic in proxy logs, the rule can help detect the presence of malware variants e.g zeus, pony, Buer Loader, Emotet wifi spreader,Kpot, Dridex,smoke loader, hancitor which have used the same naming convention for there C&C scripts  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/mQll8My6QYau"
    version = "0.01"
    created = "2021-03-09"
    product = "proxy"
    mitre = "command&control, t1043"

  events:
re.regex($selection.target.url, `.*/gate\.php`)

  condition:
    $selection
}