Data Source: PAN-OS Logs | Detection.FYI

First Seen External MQTT Broker Connection

Sep 28, 2026 · Domain: Network Use Case: Network Security Monitoring Use Case: Threat Detection Tactic: Command and Control Data Source: PAN-OS Logs Data Source: Suricata Logs Data Source: Zeek Rule Type: New Terms Resources: Investigation Guide ·
Share on:

Identifies the first MQTT relationship from an internal source to an external broker that was not observed during the previous 14 days. MQTT is commonly used by IoT and messaging applications, but malware including BambooToken, IOCONTROL, MQsTTang, and WailingCrab has used publish/subscribe traffic for command and control.

Read More