Grandoreiro MQTT C2 via AWS IoT/Azure IoT Hub/GCP from non-IoT process on port 8883

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

This rule detects potentially unauthorized processes establishing network connections over port 8883 (MQTT/MQTTS) to major cloud IoT platforms (AWS IoT, Azure IoT Hub, GCP PubSub). It flags processes that are not common web browsers and calculates a suspicious score based on data volume, execution path (e.g., Temp or AppData), and the process name not matching known legitimate IoT software.