Malicious SharePoint C2 Queues (DPRK jupyter-powerdev)
Detects Graph API or SharePoint activity interacting with specific lists or a site GUID used by the jupyter-powerdev backdoor for Command and Control (C2) operations. This activity is indicative of the jupyter-powerdev malware leveraging SharePoint as a C2 channel.
Microsoft Sentinel (KQL)
