Decoy C2 Connection to Anthropic
Detects network connections to the decoy C2 domain api.anthropic.com originating from development runtimes like Node.js, Python, or Bun. The Miasma/Shai-Hulud malware actively uses this specific domain as a decoy to obscure its data exfiltration and C2 traffic.
Sigma
