Outbound Connection to Moonrise C2 IP
This rule detects outbound network connections from devices to a known Moonrise C2 IP address (193.23.199.88). It specifically looks for successful connections, inbound connections accepted, or connection attempts to this malicious IP.
Microsoft Sentinel (KQL)
