SignalHunt
← All rules

WEBPROXY-9003

high

Repeated Requests to an Uncategorized Domain (Possible C2 Beaconing)

Detects a high volume of requests from the same client to the same uncategorized external domain within a short window - the network signature of malware beaconing to its C2 server at a fixed interval, which produces many small, regular HTTP/HTTPS requests rather than normal human browsing behavior.

T1071.001

Detection logic

{
  "detection_type": "threshold",
  "selection": {
    "category": "uncategorized"
  },
  "groupby": "domain",
  "timeframe_minutes": 5,
  "threshold": 20,
  "condition": "gte"
}

Log source: category=web_proxy · Event ID(s): proxy_request

Required log fields

  • category
  • domain
  • src_ip
  • timestamp

Enabling this in your environment

Where: Web proxy request logging - per-request, not aggregated

Ensure the proxy logs every individual request (not just a rolled-up session summary) with domain and category, so request frequency per domain can actually be counted.

"uncategorized" is a deliberately broad selection - most category feeds haven't yet classified brand-new or low-traffic C2 infrastructure, so it lands in the uncategorized bucket by default rather than being pre-flagged as malicious.

False positives

  • A legitimate application doing frequent polling/health-checks against its own uncategorized backend API domain
  • A single-page web app whose assets/API calls all hit an uncategorized domain rapidly on page load

References