Drun/CryptoBandits Exfiltration via Discord Webhooks with Suspicious User-Agents
Detects suspicious network connections or process activity targeting Discord webhooks or API endpoints, potentially indicating data exfiltration, command and control, or token validation by malicious actors. The rule specifically looks for non-Discord processes making these connections or using suspicious user agents.
Microsoft Sentinel (KQL)
