UNC3753 Infrastructure Connection
Detects DNS requests to domains matching known UNC3753 data leak sites or phishing domains masquerading as IT helpdesks. Identifying connections to these domains can serve as an early warning of an ongoing vishing campaign or active extortion scenario.
Sigma
