UAC-0226 GIFTEDCROOK: PowerShell HTTPS Callback to High Non-Standard Port
Detects network activity initiated by PowerShell or PWSH processes connecting to a known GIFTEDCROOK C2 IP address or utilizing high non-standard ports (>=8000) for outbound communication. This rule monitors for potential beaconing or command and control activity originating from non-Microsoft signed processes in public network ranges.
SentinelOne
