OpenSUpdater – C2 Communication
This rule detects network connections originating from hosts to specific remote domains ('codeonicinc.com', 'setupsoftwarecenter.com') which are associated with OpenSUpdater command and control (C2) activity. It leverages Microsoft Defender DeviceNetworkEvents to identify endpoints communicating with these known malicious infrastructure components.
Microsoft Sentinel (KQL)
