ZOHOMURK C2 via Zoho WorkDrive from Non-Browser Process in Suspicious Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

Detects network connections to Zoho WorkDrive or Zoho Accounts from non-standard or suspicious processes. The rule identifies potential unauthorized data exfiltration or cloud access by flagging processes running from temporary or user-writable directories (e.g., AppData, ProgramData), processes known to be associated with specific threats, or processes exhibiting signs of binary sideloading based on their parent process ancestry.