Attackers drain BTCPay Server hot wallets on version 2.4.1 and older
https://sockanalyst.com/patch-now/btcpay-server-hot-wallet-thefts-2-4-1

Splunk
index=* ("bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7" OR "ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee"
 OR (sourcetype=docker* container_name="*btcpayserver*" ("Login" OR "/login" OR "/server/users")))
| stats count min(_time) as first max(_time) as last by host, sourcetype, src_ip

Sentinel
let wallets = dynamic(["bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7","ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee"]);
union isfuzzy=true
 (Syslog | where SyslogMessage has_any (wallets) or (ProcessName has "btcpay" and SyslogMessage has_any ("Login","/server/users"))),
 (ContainerLogV2 | where ContainerName has "btcpay" and (LogMessage has_any (wallets) or LogMessage has "Login"))
| project TimeGenerated, Computer, ProcessName, SyslogMessage, LogMessage