HackTool - BabyShark Agent Default URL Pattern

Title: HackTool - BabyShark Agent Default URL Pattern
Status: test
Description:Detects Baby Shark C2 Framework default communication patterns
References:
  -https://nasbench.medium.com/understanding-detecting-c2-frameworks-babyshark-641be4595845
Author: Florian Roth (Nextron Systems)
Date: 2021-06-09
modified:2024-02-15
Tags:

• -'attack.command-and-control'
• -'attack.t1071.001'

Logsource:

• category: proxy

Detection:
  selection:
    c-uri|contains: 'momyshark\?key='
  condition:selection
Falsepositives:
  -Unlikely
Level: critical