US-First RMM phishing campaign domains/IP/payload URL IOC hunt

Arnold Chan@slaz

•updated 27 days ago•8•0•14

This rule detects network connections or process command lines associated with known malicious domains, IP addresses, or payload URLs. Additionally, it correlates connections to common public file-sharing platforms or APIs (e.g., Gofile, Telegram) if these events occur on the same device within a 60-minute window of a confirmed malicious infrastructure event, reducing false positives from legitimate uses of shared infrastructure.