OP-512 C2 Infrastructure Connection
Detects outbound network connections to known Command and Control (C2) IP addresses associated with the OP-512 threat actor, which are used as fallback infrastructure, including Meterpreter. This rule specifically looks for connections to '43.160.202.246' and '140.206.161.227'.
Microsoft Sentinel (KQL)
