SNOWLIGHT/VSHELL C2 Traffic Blending via Akamai and Microsoft CDN Domains
Detects network outbound connections to known CDN domains over port 8084. This activity is often associated with the use of specific C2 frameworks (e.g., SNOWLIGHT or VSHELL) that leverage legitimate cloud infrastructure to blend malicious traffic within common CDN communication patterns.
Splunk (SPL)
