Detect Suspicious Application Installation and Network Activity

Subash Ghimire@iamsubashg

•updated Feb 3, 2026•15•1•136

This query detects the installation of a potentially unwanted or suspicious application, correlates it with network activity to public IPs, indicating possible telemetry, data exfiltration, or command and control behavior. The rule appears to be valid.