Potentially Suspicious Network Connection To Notion API

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•17

Detects network connections to the Notion API (api.notion.com) from processes that are not recognized legitimate Notion applications or common web browsers. This rule aims to identify potential covert command and control (C2) channels, specifically referencing tools like "OffensiveNotion C2" which leverage Notion's infrastructure for malicious communication.