Suspicious Network Connection to EDR C2 URLs

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•0

This rule detects suspicious network connections made by processes (excluding legitimate EDR processes like mssense.exe and senseir.exe) to URLs commonly associated with EDR command and control (C2) infrastructure. This could indicate an attempt by an adversary to communicate with or manipulate the EDR agent.