Trum3it Miasma/MYRA C2 Exfiltration to Vercel and Attacker Infrastructure
This rule monitors for DNS queries, network connections, and HTTP proxy requests originating from node/npm processes or targeting known infrastructure associated with the Trum3it campaign. It covers common malicious domains and specific Vercel subdomains identified as command-and-control (C2) endpoints.
Microsoft Sentinel (KQL)
