Amatera Stealer C2 Communication (Bogus SNI)
This rule detects Command and Control (C2) communication associated with the Amatera Stealer malware. It specifically looks for TLS traffic where the Server Name Indication (SNI) field contains the string "aether100pronotification.table.core.windows.net". This SNI is considered bogus and indicative of Amatera Stealer's C2 activity.
YARA-L
