DoH Traffic from Edge Devices (BRICKSTORM)
Detects DNS over HTTPS (DoH) traffic originating directly from edge appliances (e.g., to 8.8.8.8 on port 443), which VerdantBamboo uses to obscure BRICKSTORM C2 resolution.
Microsoft Sentinel (KQL)
Detects DNS over HTTPS (DoH) traffic originating directly from edge appliances (e.g., to 8.8.8.8 on port 443), which VerdantBamboo uses to obscure BRICKSTORM C2 resolution.
Already have an account?