Azure App Service C2 Activity (Obsidian Sandstorm)

Ethan Andrews@eandrews

•updated Jun 5, 2026•3•0•5

Detects network connections to Azure App Services domains containing healthcare or service-themed keywords originating from non-browser processes. Obsidian Sandstorm utilizes these tailored subdomains for C2 communications to blend in with legitimate enterprise network traffic.