Fortinet/Ivanti VPN Phishing or C2 Activity
Detects network connections to known malicious domains or IP addresses associated with Fortinet or Ivanti VPN phishing campaigns or command and control infrastructure. This rule identifies attempts to connect to fake VPN portals or communicate with adversary-controlled servers.
Microsoft Sentinel (KQL)
