Detection of Take-Home Interview Malware Activity

Syed Usfar Wasim@nCD24

•updated Jul 14, 2026•55•0•24

This KQL detects activity associated with network traffic to known C2 infrastructure (45.146.252.17), suspicious Node/NPM execution chains and dropped payload/marker files. Also looks for indicators of remote control, clipboard access, screenshot/desktop-control packages, Socket.IO C2 traffic, and file/browser/wallet data exfiltration behavior.