FormBook RAT C2 Communication via Known IP and Dynamic DNS on Non-Standard Port
This detection identifies Command and Control (C2) communication associated with the FormBook RAT, specifically targeting connections to a known malicious IP address and dynamic DNS domain on an unusual port. Detecting C2 activity is crucial for identifying active compromises and preventing data exfiltration or further malicious commands.
Microsoft Sentinel (KQL)
