Obsidian Sandstorm C2 Beaconing to Azure App Services (azurewebsites.net)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

Detects recurring network connections (beaconing) to domains ending in 'azurewebsites.net' over HTTPS (port 443). The rule identifies potential command and control (C2) behavior by aggregating counts of connections and distinct destination IPs per process and host over time, flagging activity that exhibits regular, repeating patterns.