ROOFDECK C2 dead-drop resolution via Pastebin raw and delay.servehttp.com
Detects a potential command and control (C2) dead-drop sequence where a non-browser process fetches raw content from Pastebin and subsequently contacts a specific C2 domain within the same process context.
Microsoft Sentinel (KQL)
