AI Webchat as Covert C2 Proxy via WebView2
This rule detects suspicious activity related to WebView2 processes interacting with AI webchat domains, potentially indicating covert command and control (C2) proxying or other malicious use. It looks for WebView2 traffic to specific AI domains (Grok, Copilot) originating from unusual parent processes, WebView2 access to Grok with URL parameter-driven prompt execution, and suspicious child process execution (cmd.exe, powershell.exe, calc.exe) where WebView2 is the parent process.
Microsoft Sentinel (KQL)
