UAC-0226 GIFTEDCROOK C2 Beaconing: Hardcoded IPs and HTTPS Jitter Detection
Detects command and control (C2) activity attributed to threat actor UAC-0226 by monitoring for direct network connections to known hardcoded C2 IP addresses from suspicious process paths or PowerShell, and by identifying beaconing patterns (regular HTTPS intervals) originating from non-browser processes in sensitive locations like ProgramData or AppData/Local/Temp.
Microsoft Sentinel (KQL)
