DragonForce TURN/MQTT campaign IOC sweep (hashes, IPs, domains, URLs)
This rule performs a retrospective sweep for indicators of compromise (IOCs) associated with the DragonForce TURN/MQTT campaign, as detailed in Lab52 threat research. It monitors for file and process activity matching known malicious hashes, as well as network connections to specific domains and URLs associated with the campaign's command-and-control infrastructure.
Microsoft Sentinel (KQL)
