Cryptojacking via ScreenConnect - Directdownload IP Check
This rule detects outbound network communication to a known command and control (C2) IP address (193.42.11.108) on port 8041, specifically when initiated by processes named 'RuntimeHost.exe' or 'InstallUtil.exe'. This activity is indicative of cryptojacking, potentially leveraging ScreenConnect for initial access or persistence, as described in the referenced Microsoft blog.
Microsoft Sentinel (KQL)
