Network Connection Initiated To BTunnels Domains
Detects network connections to domains associated with BTunnels, a service that can be abused by attackers to establish reverse shells or persistence on a machine. The rule specifically looks for outbound connections where the destination hostname ends with '.btunnel.co.in'.
Sigma
