Azazel Operation - Outbound connection to confirmed C2/staging/exfil infrastructure
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Suricata

