APT28 Cloud C2 via Koofr, IceDrive, Filen
This rule detects network connections to cloud storage services Koofr, IceDrive, and Filen (koofr.net, icedrive.net, filen.io, filen.net, filen-1.net, filen-2.net) from non-browser processes. This activity is indicative of potential command and control (C2) communication, as APT28 has been observed using these services for C2, with tools like Covenant Grunt and BeardShell communicating via their APIs. The rule specifically filters out connections originating from common web browsers (msedge.exe, chrome.exe, firefox.exe) to reduce false positives.
Sigma
