DragonReturn Malicious ITR ZIP Download from govtop[.]one or Actor IPs
This rule detects network activity involving connections to known malicious IP addresses or DNS domains ('govtop.one') and subsequent attempts to download specific suspicious file payloads, such as archives or image files often associated with malicious activity. This activity is indicative of potential command and control communication or initial malware ingress.
Cortex XDR
