Chaos msaRAT - DNS query for Twilio TURN relay domain global.turn.twilio.com (low-confidence, contextual indicator only - correlate with other msaRAT indicators)
Detects DNS queries for the Twilio TURN relay domain 'global.turn.twilio.com', which is associated with msaRAT C2 activity. This indicator is low-confidence and intended to be used as part of a correlation with other behaviors like loopback C2 traffic or suspicious DevTools usage.
Suricata
