Data Source: PAN-OS Logs | Detection.FYI

First Seen External MQTT Broker Connection

Oct 20, 2026 · Domain: Network Domain: OT/IoT Platform: AWS Use Case: Network Security Monitoring Use Case: Threat Detection Tactic: Command and Control Data Source: PAN-OS Logs Data Source: Network Traffic Data Source: Network Packet Capture Data Source: Suricata Logs Data Source: Zeek Service: AWS IoT Rule Type: New Terms Resources: Investigation Guide ·
Share on:

Identifies the first MQTT relationship from an internal source to an external broker that was not observed during the previous 14 days. This includes protocol-decoded MQTT and direct AWS IoT Core MQTT identified from TLS ClientHello metadata without decryption. MQTT is commonly used by IoT and messaging applications, but malware including BambooToken, IOCONTROL, MQsTTang, and WailingCrab has used publish/subscribe traffic for command and control.

Read More