HarborWatch Infrastructure Communication
Detects network connections to known HarborWatch C2 server IPs and associated fake-Amazon infrastructure domains, directly identifying compromised hosts communicating with this threat actor's infrastructure.
Microsoft Sentinel (KQL)
