GIFTEDCROOK - C2 Exfiltration Connection to Known Command-and-Control Infrastructure
This rule monitors DeviceNetworkEvents for outbound network connections to a specific IP address (142.111.194.73), destination port (8640), or URL path (/dj5FZEiLnA/) associated with the 'GiftedCrook' command and control infrastructure.
Microsoft Sentinel (KQL)
