Grandoreiro WebRTC/STUN C2 via pubsub.googleapis.com, Azure MQTT, AWS MQTT port 8883
This rule monitors for network connections that occur over non-standard ports (STUN, MQTT) or to specific suspicious IP addresses and domains, while excluding known legitimate user-facing applications. The detection aims to identify potentially malicious command and control (C2) communication or unauthorized network activity performed by non-standard processes.
Cortex XDR
