DOGLEASH multi-architecture payload staging and deployment script delivery from VPS
Detects network connection events where the requested URL contains 'dogleash' and includes common architecture suffixes (mips, arm, x64) or shell script extensions (.sh), often indicative of downloading stage payloads associated with the Dogleash malware family.
Microsoft Sentinel (KQL)
