Remcos RAT Loader C2 Communication
Detects HTTP C2 communication patterns associated with Remcos RAT loader by monitoring network events for specific URLs and known malicious IP addresses. This rule identifies outbound network connections to hardcoded malicious IPs and specific URL paths often used for command and control by Remcos.
Microsoft Sentinel (KQL)
