DarkSword exploit-host and C2 infrastructure connections (ports 8881/8882)
Detects endpoint connections to known DarkSword/Coruna exploit-host and C2 infrastructure. The shared AWS IP is only matched on C2 ports 8881/8882 to reduce collateral hits.
Microsoft Sentinel (KQL)
