1C rphost.exe outbound connection to attacker PostgreSQL C2 IP
Detects network communication originating from the 1C:Enterprise server process (rphost.exe) to a specific remote IP address and port associated with potential malicious activity.
Microsoft Sentinel (KQL)
