TinyRCT C2 Beaconing to 45.32.113.172 or 139.180.134.221 from PerfWatson2.exe
Detects network activity initiated by PerfWatson2.exe communicating with known command-and-control (C2) IP addresses. PerfWatson2.exe is used as a masquerading process to blend in with legitimate Visual Studio telemetry traffic, a technique observed in TinyRCT C2 beaconing.
Splunk (SPL)
