CL-STA-1062 XDRAgent.exe Masquerading Tunneling Tool Reverse Tunnel to C2
This rule detects the execution of processes masquerading as legitimate VMware-related utilities or XDR agents when they exhibit behaviors associated with command-and-control (C2) activity. Specifically, it flags processes matching these names or non-standard file paths that include command-line arguments indicative of tunneling (e.g., 'reverse', 'admin-auth-flag') or connect to a specific, hardcoded malicious IP address on port 41256.
Microsoft Sentinel (KQL)
