All Detections

Glassworm - BitTorrent DHT C2 Queries (T1090.003)

avatar
Ibrahim Saud@tektrix
updated Jun 20, 2026102

Correlates payload execution with anomalous BitTorrent DHT UDP traffic (ports 10000/6881) used for distributed C2 path retrieval.

Microsoft Sentinel (KQL)