Notepad++ Supply Chain Attack - Malicious C2/Exfil Domains
Detects network connections or DNS queries to known malicious domains identified as being used for Cobalt Strike C2, data exfiltration, and secondary payload delivery during the Notepad++ supply chain attack. This rule specifically targets the domains 'cdncheck.it.com', 'safe-dns.it.com', 'self-dns.it.com', 'api.wiresguard.com', 'api.skycloudcenter.com', and 'temp.sh'.
Microsoft Sentinel (KQL)
