Shadow Campaigns TGR-STA-1030 C2 DNS Activity
This rule detects DNS queries to known command and control (C2) domains associated with the 'Shadow Campaigns' (TGR-STA-1030) threat group. Specifically, it looks for DNS queries ending in '.me' or '.live' that match a list of hardcoded domain patterns identified by Unit 42 as being used by this threat actor for C2 communications.
Microsoft Sentinel (KQL)
