Turla Kazuar v3 Network Communication
Detects network connections to Kazuar v3 command and control servers. The malware communicates with C2 infrastructure using HTTP/HTTPS protocols (ports 80/443) to any internet-routable IPv4 address. The loader uses WinHttp.WinHttpRequest.5.1 COM object for HTTP requests and ignores SSL certificate validation errors (SXH_SERVER_CERT_IGNORE_ALL_SERVER_ERRORS = 13056). File downloads are performed using ADODB.Stream, and User-Agent strings typically contain "WinHttp" or "ADODB" indicators. This rule matches any valid IPv4 address to account for the fact that Turla may use different C2 IPs across campaigns. The rule focuses on HTTP/HTTPS traffic which is the primary communication method used by the loader to download components and exfiltrate data.
Sigma
