Obsidian Sandstorm C2 to Azure App Services Subdomains by Non-Browser Processes
Detects command-and-control (C2) communication patterns associated with the threat group Obsidian Sandstorm (Storm-2571). The rule monitors for network connections and DNS queries to various Azure App Services subdomains initiated by suspicious processes running from user-accessible temporary directories (AppData or Temp), excluding known browser processes. This technique leverages legitimate cloud infrastructure for malicious command delivery.
Sigma
