Endpoint network connections to Kimsuky home.kg infrastructure (domains & IPs)

F S@Fsdr

•updated Sep 9, 2026•11•0•13

Detects outbound network connections from endpoints to domains and IP addresses associated with the Kimsuky (APT43) threat actor group. This rule leverages endpoint network telemetry to identify potential command and control (C2) communication or data exfiltration activities.