Lazarus Group Malware C2 via Raw TCP
Detects potential command-and-control (C2) activity associated with Lazarus Group malware, such as Cryptoistic. This rule identifies outbound TCP connections that do not appear to be using a standard application-layer protocol like HTTP/S, which is a characteristic of some custom backdoors used by the group. The rule filters for successful outbound TCP connections with an empty RemoteUrl, excluding private IP ranges and a allowlist of common processes. It further prioritizes processes running from suspicious user-writable locations and requires more than two connection attempts to reduce noise.
Microsoft Sentinel (KQL)
