CNCMachineRMS C2 - notepadreleased.com / 85.158.110.78
This rule detects network communication attempts (connection success, request, or failure, or any traffic on port 443) targeting a specific malicious domain (notepadreleased.com) or IP address (85.158.110.78), while explicitly excluding common public DNS providers.
Microsoft Sentinel (KQL)
