YEPlayer/Pis2ray fake VPN payload execution triggering MarkiRAT C2 beacon
Detects the execution of specific suspicious filenames ('YEPlayer.exe', 'Pis2rayVPN.msi', 'YEMPlayer.msi') or command-line references to these files, combined with correlated network activity to specific suspicious domains associated with masqueraded 'microsoft.comi-site.website' URLs.
Microsoft Sentinel (KQL)
