JDY Botnet Node Persistence: Suspicious Firmware Update Traffic to Non-Vendor Servers
Detects indicators associated with the JDY botnet targeting SOHO and IoT infrastructure. The rule monitors for suspicious firmware update attempts to non-vendor hosts, identifies high-rate outbound scanning from edge devices, and flags devices that show re-emergence of suspicious behavior after a quiet period.
Microsoft Sentinel (KQL)
