AI-Assisted Research Queries for EDR Bypass, Obfuscation, or Cloud C2 Hosting
This rule detects execution of commands or network traffic containing strings indicative of EDR bypass attempts, obfuscation frameworks, or C2 hosting/infrastructure. This usually signals active adversary efforts to evade defensive controls or setup command-and-control communication.
Cortex XDR
