Outbound Connection to Tykit Malware C2 or Credential Phishing Domain

Steven Lim@KQLWizard

•updated Dec 29, 2025•27•6•1,198

This rule detects outbound network connections to domains associated with the Tykit malware family or domains matching a specific regular expression pattern often used for credential harvesting (e.g., 'loginmicr.s*.cc'). It leverages an external intelligence feed for known Tykit domains and a regex for common phishing/credential theft patterns.