TinyRCT PerfWatson2.exe HTTP C2 Beaconing to 45.32.113.172
Detects network activity initiated by the 'PerfWatson2.exe' process, which is associated with the TinyRCT .NET backdoor, communicating with a known malicious C2 IP address (45.32.113.172). The rule monitors for network connections from this specific binary to the identified infrastructure, indicative of beaconing or command and control activity.
Cortex XDR
