SANDWORM_MODE C2/Exfil Domains

Ethan Andrews@eandrews

•updated Feb 23, 2026•7•0•64

This rule detects outbound network connections to known Command and Control (C2) and exfiltration domains associated with the SANDWORM_MODE campaign. These domains are used to exfiltrate stolen credentials and other sensitive data.