Tycoon2FA Malicious S3 Lure Access
Detects DNS queries pointing to a specific malicious AWS S3 bucket URL known to be utilized by the Tycoon2FA threat actor for hosting initial cloned Microsoft Power Pages lures. This rule identifies network activity attempting to resolve this highly specific Indicator of Compromise (IOC).
Cortex XDR
