Rekoobe C2 Infrastructure Communication
Detects outbound network connections to known command-and-control (C2) and payload delivery infrastructure associated with the Rekoobe campaign. The rule specifically looks for connections to the IP address 154.84.63.184 or domains img.spoolsv.cc, img.spoolsv.net, spoolsv.cc, and spoolsv.net.
Microsoft Sentinel (KQL)
