APT29 watering holes hit unpatched iOS/Android; CISA adds Apple CVE-2024-27834 to KEV
https://sockanalyst.com/patch-now/apt29-watering-hole-apple-android-n-days-cve-2024-27834

Splunk
index=* (dest_host="*flux-telemetry*" OR dest_host="*clouds-stacks*" OR dest_host="*starx-net*" OR dest_host="america250.holiday" OR dest_host="theowo.club" OR dest="109.104.106.107" OR dest="195.58.140.105" OR dest="95.133.231.28" OR dest="192.121.46.25" OR dest="188.190.17.232" OR url="*/telemetry/v12*")
| stats count min(_time) as first max(_time) as last values(src) as src by dest, dest_host, url

Sentinel
let badDomains = dynamic(["flux-telemetry.com","clouds-stacks.com","starx-net.com","america250.holiday","theowo.club","adsprism-stat.com"]);
let badIPs = dynamic(["109.104.106.107","195.58.140.105","95.133.231.28","192.121.46.25","188.190.17.232"]);
DeviceNetworkEvents
| where RemoteIP in (badIPs) or RemoteUrl has_any (badDomains) or RemoteUrl has "/telemetry/v12"
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName