Metro4Shell attacker infrastructure: inbound exploitation and payload hosting
Detects inbound exploitation attempts and subsequent outbound payload fetching associated with Metro4Shell (CVE-2025-11953) indicators of compromise, including known malicious source IPs and payload hosting endpoints.
Microsoft Sentinel (KQL)
