DcRAT TurboJPEG/dsc Compression Exfiltration to kkxqbh.top with debug.txt Staging
This rule detects potential command and control (C2) communication by monitoring for connections to known malicious domains or IP addresses and identifies the creation of suspicious staging files (specifically 'debug.txt') commonly used to collect or exfiltrate data.
Cortex XDR
