DDoSia client activity or NoName057(16) Tor portal contact on endpoints

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•2•0•5

Detects endpoint telemetry indicators associated with DDoSia client activity, including specific process executions, file creations/renames for executables or scripts, and network connections to NoName057(16) Tor portal infrastructure (nnmo57).