TWINLOOT SharePoint Dead-Drop C2 Tasking Channel Access
Detects network traffic indicating potential Command and Control (C2) tasking communication via Microsoft SharePoint. The rule monitors for requests to specific SharePoint paths associated with the TWINLOOT campaign, which leverages legitimate cloud infrastructure for malicious command delivery.
Suricata
