Obsidian Sandstorm C2 Beaconing to Azure App Services from Non-Browser Processes
Detects suspicious processes commonly associated with malicious activity establishing outbound network connections to Azure Web Apps domains. The rule aggregates connections to identify potential beaconing behavior by monitoring connection frequency and duration, flagging activity initiated by binaries frequently used for living-off-the-land attacks such as powershell.exe, rundll32.exe, and others.
Splunk (SPL)
