P7 DarkSword exploit-delivery and C2 domain connections

Arnold Chan@slaz

•updated 4 days ago•0•0•3

Detects devices reaching P7 DarkSword exploit-delivery hosts (cdn/js.gotoiphone.com, mzpo30.cam) and the agdx53.cc C2, with delivery-then-C2 chaining surfaced as the highest-confidence match. Matching is limited to the exact listed hosts and successful/attempted connection events.