Vidar Infostealer Dead-Drop Resolver URLs
This rule detects network connections to specific Steam and Telegram profiles known to be used by Broomstick operators as dead-drop resolvers for Vidar infostealer C2 infrastructure. The rule identifies attempts by devices to communicate with these hardcoded URLs.
Microsoft Sentinel (KQL)
