Network Connection from DbgView/VirtualBox to Public IP
Detects DbgView.exe, DbgView64.exe, or VirtualBox.exe processes making unexpected outbound network connections to public IP addresses. This behavior is associated with Backdoor.Turn, which is known to inject into these trusted processes via DLL sideloading to communicate with C2 servers, potentially routing traffic through Microsoft Teams TURN relays.
Microsoft Sentinel (KQL)
