Is it possible to find out what this triggers on?
Every Day I learn how more about how much I don't know. As soon as I submitted this post I came across this Blog post from July 2017.
https://community.netwitness.com/t5/netwitness-community-blog/malspam-delivers-cerber-ransomware-july-2017/ba-p/518101
It is a very good read. It has the following information in it that I think answers my question:
"payment domain (key.dga.tld pattern) as 'cerber ransomware' and the UDP spray as 'cerber beacon' in the <Indicators of Compromise> meta field."
