Checkmarx Malicious Infrastructure Connection
Detects network connections to known malicious infrastructure domains and IP addresses associated with the Checkmarx supply chain compromise. The compromised KICS images and mcpAddon.js payload use these hardcoded endpoints to exfiltrate stolen credentials and tokens.
Sigma
