Operation XENOFISCAL - XenoRAT C2 Connection from Unusual Process
Detects connections to a known XenoRAT C2 IP address (185.235.137.106) originating from processes other than common web browsers (mshta.exe, chrome.exe, msedge.exe). This aims to identify potentially injected shellcode or RAT processes establishing command and control communications.
Microsoft Sentinel (KQL)
