Epsilon Red Ransomware Impersonated Domains
This rule detects network connections and DNS queries to domains impersonating legitimate services, which are known to be used in the Epsilon Red ransomware campaign to deliver malicious HTA files.
Microsoft Sentinel (KQL)
