Raw TCP C2 Beacon to 212.34.141.103:4521 (MSBuild.exe abuse)

Ibrahim Saud@tektrix

•updated 19 days ago•0•0•1

This rule monitors for outbound TCP traffic from internal hosts to a specific IP address (212.34.141.103) on port 4521, which is associated with C2 beaconing behavior, potentially involving the abuse of MSBuild.exe as a LOLBin.