KuinaExtractor Infostealer C2 Connection to 103.229.53.18:3000
Detects outbound network connections to a known KuinaExtractor (k0to) infostealer C2 server. The rule monitors DeviceNetworkEvents for connections to the malicious IP address 103.229.53.18 on port 3000 and correlates them with process information to identify the originating application.
Microsoft Sentinel (KQL)
