STAC4713 QEMU SSH Reverse Tunnel C2 via External Network Connection
This rule monitors for potential C2 communications and tunneling activity associated with the STAC4713 campaign. It detects outgoing network connections to known malicious IP addresses, traffic over specific non-standard ports used for tunneling, or the execution of QEMU (qemu-system-x86_64.exe), which is often used by this threat actor to host malicious services or tunnels. The rule includes logic to suppress benign, internal-only QEMU activity.
SentinelOne
