SpiceRAT fast-flux hostname resolving to multiple known C2 IPs
Detects DNS resolutions of known SpiceRAT command-and-control hostnames to multiple distinct C2 IP addresses within a 30-day window. This behavior is consistent with automated C2 infrastructure rotation or the use of multiple redundant IP addresses for persistence.
Microsoft Sentinel (KQL)
