Sauron Loader RSA-Secured C2 Beacon to Embedded Config Domains
Detects outbound network traffic from internal hosts to known domains associated with the Sauron Loader malware family. These alerts monitor for TLS connections where the Server Name Indication (SNI) matches domains identified as part of the malware's C2 infrastructure.
Suricata
