Lumma Stealer C2 Activity Detection

Frederico Canhoto@nullwhire

•updated Jul 17, 2025•9•3•108

This rule detects network connections and DNS queries to known command and control (C2) infrastructure associated with Lumma Stealer malware. It leverages a regularly updated external list of indicators of compromise (IOCs) including IP addresses and domains to identify malicious communication attempts.