Mythic C2 High-Frequency Beaconing to External IP (T1071.001, T1102)
This rule detects potential command and control (C2) beaconing activity associated with Mythic implants. It monitors for high-frequency outbound connections (20 or more) from a single device to the same external IP address within a 30-minute window across common C2 listener ports (80, 443, 8080, 8443, 7443).
Microsoft Sentinel (KQL)
