QUICAgent Cloudflare Workers dead-drop resolver DNS/HTTP lookup
Detection of known Cloudflare Workers subdomains used as dead-drop resolvers for C2 communication by the QUICSILVER QUICAgent malware. The rule monitors for specific DNS queries to resolve these domains and subsequent HTTP GET requests used to retrieve C2 instructions.
Suricata
