All Detections

Access to logAzure.txt Containing RSA Private Key for C2 Payload Decryption

avatar
Duo Tech@duotech
updated Jul 21, 2026105

Detects file access events for 'logAzure.txt', which is used by a specific implant to store RSA private keys for C2 payload decryption.

Microsoft Sentinel (KQL)