Grandoreiro Azure/AWS IoT MQTT C2 on Port 8883 from Non-IoT Process
Detects outbound network connections over port 8883 (MQTT/IoT) indicative of the Grandoreiro banking trojan. The rule identifies suspicious, unsigned, or non-whitelisted processes attempting to initiate multiple connections to external endpoints, masquerading as legitimate IoT telemetry traffic using MQTT client configurations.
SentinelOne
