SloppyLemming C2 User-Agents
This rule detects network traffic containing specific User-Agent strings used by the BurrowShell implant and the Rust-based keylogger to masquerade as legitimate Windows Update or browser traffic. These User-Agent strings are 'Windows-Update-Agent/10.0.10011.Client-Protocol/2.50' and 'Mozilla/5.0 (compatible; SecureNet/1.2)'.
Microsoft Sentinel (KQL)
