VectraRAT/ClickFix/Amadey C2 IOC and callback.json hunt
Detects network communication with identified C2 infrastructure associated with VectraRAT, Amadey, and ClickFix campaigns, as well as the presence of a specific 'callback.json' artifact in temporary directories, which is commonly used for C2 address overrides.
Microsoft Sentinel (KQL)
