PhantomRaven known IOC hunt: C2 domains, IP, and file hashes

Arnold Chan@slaz

•updated 21 days ago•0•0•1

Detects network communication with known malicious domains and IP addresses, as well as the presence of known malicious file hashes on the system. The rule correlates network connection events, file creation events, and process creation events against predefined lists of C2 infrastructure and malware indicators.