PhantomPulse Staging Server Comm
Provides high-fidelity detection of the initial infrastructure used by the threat actor to deliver the PhantomPulse RAT. This rule specifically detects network connections to a known PhantomPulse staging server IP address.
CQL
