Repeated POST /api/credentials beaconing to Sauron Loader C2
Detects multiple HTTP POST requests to a specific credential-related API path (/api/credentials) directed at an external IP address (95.163.153.80) on a non-standard port (8133). This pattern is indicative of potential automated credential exfiltration or brute-force activity.
Splunk (SPL)
