Kamasers Dead Drop Resolver C2 Discovery via Staging Services

Ankit Mehta@Secvyn

•updated 23 days ago•0•0•3

This rule detects non-browser processes initiating network connections to common file-sharing or cloud services (e.g., GitHub Gist, Telegram, Dropbox) followed by subsequent network activity from the same process within a 5-minute window. This behavior is indicative of potential command and control (C2) communication, payload retrieval, or data staging/exfiltration using legitimate web services.