OysterLoader C2 Activity Detection
This rule detects network communication with known command and control (C2) infrastructure associated with the OysterLoader malware. It identifies C2 activity by looking for connections to specific domains and IP addresses, as well as requests to particular API paths within the RemoteUrl field.
Microsoft Sentinel (KQL)
