AXIOS compromise - Network Connection to Known Malicious Infrastructure (sfrclak.com or 142.11.206.73)

F S@Fsdr

•updated Mar 31, 2026•11•0•215

This rule detects network connections from devices to known malicious infrastructure, specifically the domain 'sfrclak.com' or the IP address '142.11.206.73'. These indicators are associated with potential compromise or command and control activity.