Google Doc Sidebar: Network connections to campaign C2 domains (web12api, eu03hub, gta6main*)

Arnold Chan@slaz

•updated 7 days ago•1•0•0

This rule monitors DeviceNetworkEvents for any outbound network connections to a specific list of known malicious domains. The rule identifies potential command and control (C2) communication by matching remote URLs against a hardcoded set of domains associated with known threats.