ASP.NET Identity Data Exfiltration Endpoints via Malicious NuGet Packages

Ethan Andrews@eandrews

•updated Feb 23, 2026•3•0•33

Detects network requests to specific URI endpoints associated with the DOMOAuth2_ and IRAOAuth2.0 malicious NuGet packages. These packages exfiltrate ASP.NET Identity data to a local C2 proxy. The rule specifically looks for traffic to these URIs on localhost via port 7152.