DarkCloud Campaign Domain Access

Aaron Mog@AaronMogS2S

•updated Aug 11, 2025•2•21

Detects DNS queries for domains known to be used by the DarkCloud campaign for payload delivery and C2 communication. This rule specifically targets domains used for initial payload download, final payload delivery, and public IP address determination.