SysGoRAT / CL-UNK-1211 masquerading processes, C2 IPs and domains
Detects process execution and network connection events associated with SysGoRAT or CL-UNK-1211, identifying known indicators of compromise including specific process names, command-line usage, C2 IP addresses, and malicious domains.
Microsoft Sentinel (KQL)
