Sapphire Sleet - Mach-O Network C2 Polling
Detects a compiled Mach-O binary residing in a hidden directory (e.g., ~/.config/) making periodic TCP connections to known C2 subnets on common web ports (80, 443, 8080).
Microsoft Sentinel (KQL)
Detects a compiled Mach-O binary residing in a hidden directory (e.g., ~/.config/) making periodic TCP connections to known C2 subnets on common web ports (80, 443, 8080).
Already have an account?