SectopRAT AES C2 exfil beacon on port 15847
Detects outbound network connections to known SectopRAT C2 infrastructure, specifically targeting the hardcoded IP 98.142.252.140 or the non-standard port 15847 often used for encrypted exfiltration.
Microsoft Sentinel (KQL)
