ScreenConnect C2 IPs (Storm-2949)
Detects network traffic to known Storm-2949 ScreenConnect infrastructure IPs. This rule identifies outbound network connections from devices to specific IP addresses associated with command and control (C2) infrastructure used by the Storm-2949 threat group, leveraging ScreenConnect for remote access.
Microsoft Sentinel (KQL)
