Terraform process activity followed by connection to ROOFDECK/FLATROOF C2 infras
Detects a sequence where a Terraform provider process executes on a developer host, followed by the same device establishing a network connection to known ROOFDECK or FLATROOF C2 domains or IP addresses within 1 hour.
Microsoft Sentinel (KQL)
