NodeSnake/Supper SOCKS5 Proxy C2 Ports
Detects unusual network communication from runtime processes mapped to Interlock/Rhysida backdoors on specific documented proxy C2 ports (1080, 4043, 8080). The rule specifically targets 'node.exe', 'java.exe', and 'javaw.exe' processes initiating these connections.
Microsoft Sentinel (KQL)
