When a botnet cries: Detecting botnet infection chains

When a botnet cries: Detecting botnet infection chains is a Sekoia.io research paper (Virus Bulletin 2023 talk) that examines how common botnet infection chains evolve, highlights families like BumbleBee, QNAPWorm, IcedID and Qakbot, and advocates for generic detection methods — notably Sigma correlation rules for ISO-LNK chains — plus a threat intelligence-driven pipeline for tracking C2 servers, extracting configurations, and testing detection rules.