Phishing Abuses RMM Tools: C2 Domain Contact (MSP360/ScreenConnect Campaign)
This rule monitors for DNS queries and network connections to a known list of malicious domains associated with phishing campaigns that deploy remote access tools (such as ScreenConnect or MSP360). These campaigns typically involve users interacting with malicious links to trigger downloads or remote management sessions.
Microsoft Sentinel (KQL)
