LONGLEASH (ff-agent) multi-protocol proxy and C2 relay activity
Detects the 'ff-agent' process exhibiting unusual network behavior, specifically involving multiple network protocols or connections to a high number of distinct remote ports within a one-hour window. This behavior is indicative of potential command and control (C2) communication, network reconnaissance, or proxy activity.
Microsoft Sentinel (KQL)
