CountLoader C2 Domain Communication
Detects network connections to known CountLoader C2 domains based on McAfee Labs analysis. This rule identifies outbound network traffic from devices to a predefined list of Command and Control (C2) domains associated with the CountLoader malware. The detection logic specifically looks for the presence of these domains in the 'RemoteUrl' field of network events.
Microsoft Sentinel (KQL)
