Python Bare IP Connection
Detects Python scripts making outbound network connections directly to IP addresses without prior DNS resolution. This behavior can strongly indicate hardcoded Command and Control (C2) communication, where an adversary has embedded the C2 server's IP address directly into the script to bypass DNS-based security controls or to ensure connectivity even if DNS is compromised or unavailable. The rule filters out private IP addresses and aggregates connections by device and remote IP, flagging those with a low connection count (less than 10) to reduce noise from legitimate, high-volume bare-IP traffic.
Microsoft Sentinel (KQL)
