Tycoon2FA Domain Network Traffic
Detects DNS queries or network connections resolving to known Tycoon2FA credential harvesting, kill switch, and link management domains post-takedown. This rule specifically targets precise indicators of compromise (IoCs) associated with the rebuilt Tycoon2FA infrastructure.
Cortex XDR
