IOC-Based Malicious Activity Detection
This rule detects communication with known malicious domains and IP addresses, as well as the presence or execution of files with known malicious MD5 or SHA256 hashes. It correlates threat intelligence with network and endpoint telemetry to identify compromised devices or accounts.
Microsoft Sentinel (KQL)
