Malicious Node.js C2 Connections to Developer-Targeting Infrastructure
Detects a Node.js process making outbound network connections to known malicious infrastructure associated with a developer-targeting campaign. The campaign used Vercel for staging and specific IPs for C2.
Microsoft Sentinel (KQL)
