SPECTRALVIPER C2 Infrastructure Contact - Known IPs and Domains
This rule detects network communication (DNS, connection, or traffic) with known infrastructure and specific URI paths associated with the SpectralViper threat actor. It enriches these findings by identifying if the communication originated from processes commonly associated with SpectralViper, such as OneDrive Sync services or specific Intel audio service files.
Splunk (SPL)
