T1557 Claims Kit First-Party Exfil: X-Enc Single-Letter C2

The client-to-server channel of the ShinyHunters "The Com" claims-impersonation kit. Unlike the Telegram-relay kits that dominate this ecosystem, this variant exfiltrates first-party: captured credentials and MFA codes are POSTed to the kit's own origin over a compact set of single-letter routes (/e login and OTP, /w captcha returning the panel type, /z operator status, plus /d /y /m /u /x), with bodies sent as Content-Type text/plain carrying the header X-Enc: 1 and a base64 payload. The payload is not encrypted in any meaningful sense, it is a byte-wise XOR against a 32-byte keystream derived from the _fbc Meta Pixel click-identifier cookie the page sets, so a defender with the request and the cookie recovers the plaintext offline. This rule matches the X-Enc header on a POST (the strongest single indicator, as the header is specific to this kit) and, separately, a POST of a text/plain body to one of the single-letter routes served by a Next.js asset host. The routes alone are generic; require the text/plain body or the X-Enc header to scope. Because the exfil is first-party rather than to Telegram, a Telegram-based detection will not see this kit, this channel is its strongest discriminator.

Rule ID

364fbafd-91fb-4816-9dc9-be90b870f0fb

Status

experimental

Level

high

Log source

category: proxy

Date

2026-09-12

Modified

2026-09-12

ATT&CK

T1027.013 , T1557 (signal rollup)

Canonical YAML

t1557-claims-kit-single-letter-c2-xenc.yml

References

• https://thrunt.me/research/2026-09-12-claims-kit-recaptcha-turnstile-xor-exfil/
• https://attack.mitre.org/techniques/T1557/
• https://attack.mitre.org/techniques/T1027/013/

False positives

• Applications that legitimately POST text/plain bodies to short API routes. The single-letter paths are generic; keep them paired with the text/plain content type, and where possible add the requirement that the host is not a sanctioned application. The X-Enc header selection is specific to this kit and should rarely false-positive.
• Beacon, telemetry, or analytics endpoints that use single-character paths. Allowlist the known destinations rather than removing the route list.
• Proxy or WAF products that do not log request headers will not populate the X-Enc field; in those environments rely on selection_singleletter_textplain and confirm at the host.

Rule YAML

title: 'T1557 Claims Kit First-Party Exfil: X-Enc Single-Letter C2'
id: '364fbafd-91fb-4816-9dc9-be90b870f0fb'
status: 'experimental'
description: 'The client-to-server channel of the ShinyHunters "The Com" claims-impersonation kit. Unlike the Telegram-relay kits that dominate this ecosystem, this variant exfiltrates first-party: captured credentials and MFA codes are POSTed to the kit''s own origin over a compact set of single-letter routes (/e login and OTP, /w captcha returning the panel type, /z operator status, plus /d /y /m /u /x), with bodies sent as Content-Type text/plain carrying the header X-Enc: 1 and a base64 payload. The payload is not encrypted in any meaningful sense, it is a byte-wise XOR against a 32-byte keystream derived from the _fbc Meta Pixel click-identifier cookie the page sets, so a defender with the request and the cookie recovers the plaintext offline. This rule matches the X-Enc header on a POST (the strongest single indicator, as the header is specific to this kit) and, separately, a POST of a text/plain body to one of the single-letter routes served by a Next.js asset host. The routes alone are generic; require the text/plain body or the X-Enc header to scope. Because the exfil is first-party rather than to Telegram, a Telegram-based detection will not see this kit, this channel is its strongest discriminator.'
references:
    - 'https://thrunt.me/research/2026-09-12-claims-kit-recaptcha-turnstile-xor-exfil/'
    - 'https://attack.mitre.org/techniques/T1557/'
    - 'https://attack.mitre.org/techniques/T1027/013/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-09-12'
modified: '2026-09-12'
tags:
    - 'attack.credential_access'
    - 'attack.t1557'
    - 'attack.exfiltration'
    - 'attack.defense_evasion'
    - 'attack.t1027.013'
    - 'tlp.clear'
logsource:
    category: 'proxy'
detection:
    selection_xenc_header:
        cs-method: 'POST'
        X-Enc: '1'
    selection_singleletter_textplain:
        cs-method: 'POST'
        cs-content-type|contains: 'text/plain'
        cs-uri-stem:
            - '/e'
            - '/w'
            - '/z'
            - '/d'
            - '/y'
            - '/m'
            - '/x'
    condition: 'selection_xenc_header or selection_singleletter_textplain'
falsepositives:
    - 'Applications that legitimately POST text/plain bodies to short API routes. The single-letter paths are generic; keep them paired with the text/plain content type, and where possible add the requirement that the host is not a sanctioned application. The X-Enc header selection is specific to this kit and should rarely false-positive.'
    - 'Beacon, telemetry, or analytics endpoints that use single-character paths. Allowlist the known destinations rather than removing the route list.'
    - 'Proxy or WAF products that do not log request headers will not populate the X-Enc field; in those environments rely on selection_singleletter_textplain and confirm at the host.'
level: 'high'

The YAML file is the rule, and this page displays it. Scripts should read /sigma/manifest.json and fetch t1557-claims-kit-single-letter-c2-xenc.yml directly. The intel context for every rule is in /sigma/evidence.json, keyed by slug.