Identifies the first MQTT relationship from an internal source to an external broker that was not observed during the previous 14 days. This includes protocol-decoded MQTT and direct AWS IoT Core MQTT identified from TLS ClientHello metadata without decryption. MQTT is commonly used by IoT and messaging applications, but malware including BambooToken, IOCONTROL, MQsTTang, and WailingCrab has used publish/subscribe traffic for command and control.

Read More

Identifies a Linux process running from a potentially suspicious location that resolves an account-specific AWS IoT Core data endpoint and then connects over TCP/443 or TCP/8883. Adversaries can use an attacker-controlled AWS IoT Core MQTT broker to relay commands, results, and files without a direct connection from the compromised host to the operator's backend server.

Read More

Identifies AWS IoT Secure Tunneling localproxy started in destination mode that then resolves and connects to the Secure Tunneling data plane, data.tunneling.iot..amazonaws.com, on TCP/443. Destination mode opens no listener; once the operator joins the tunnel the proxy forwards streams to a local service such as SSH on 127.0.0.1:22. Public red-team research shows this signed, documented binary used as post-exploitation C2 that resembles legitimate IoT device management. OpenTunnel and access tokens live in the operator's AWS account, not the victim's.

Read More