WeaselBiscuit Loader TLS SNI to api.npoint.io C2 Dead Drop
Detects network traffic initiated by the WeaselBiscuit loader targeting api.npoint.io, a known free JSON storage service often abused by adversaries as a dead drop resolver for Command and Control (C2) configurations or secondary payloads.
Suricata
