PassMark Multicast Discovery Traffic
Detects UDP multicast traffic to 224.0.0.255 on port 31339. This traffic is normally used by the PassMark Endpoint utility (BurnInTest) for peer discovery, but has been observed being repurposed by threat actors such as UAC-0184 to establish a stealthy command and control channel.
Sigma
