Threat Hunt: APT35 - Subtle Snail - Suspicious Executable/DLL Activity with Cloud-Hosted C2 on Azure Infrastructure
Hunts for multi-stage attacker behavior involving executables dropped to user directories, co-located DLL loads, and outbound network connections to Azure cloud domains used as command-and-control infrastructure. This query surfaces advanced adversary tradecraft where payload delivery, code execution, and cloud-based C2 are tightly correlated.
Microsoft Sentinel (KQL)
