SectopRAT IOC sweep: C2 IP/port, backup domains, malicious file hashes
This rule performs indicator-based detection for the SectopRAT malware. It monitors network activity for connections to known command-and-control (C2) IP addresses and backup domains, as well as file and process creation events matching known malicious SHA256 hashes associated with the malware.
Microsoft Sentinel (KQL)
