BambooToken MQTT C2 to external broker on port 1883/8883
Detects outbound network connections from internal devices to public IP addresses over standard MQTT (1883) or MQTT over TLS (8883) ports. MQTT is frequently used for IoT communication but can be abused for command and control (C2) or unauthorized data exfiltration.
Microsoft Sentinel (KQL)
