Only the Elected Kazuar Leader Communicates Externally
Detects several related module processes on one host while a single process accounts for all external network connections. This behavior is indicative of the Kazuar malware, which uses a botnet-like structure where one 'leader' process handles C2 communications.
Splunk (SPL)
