Feodo Tracker Malicious IP Connection Detection

This detection identifies connections to malicious IPs from the Feodo Tracker blocklist, tracking C2 servers for banking trojans like Emotet, Dridex, and TrickBot.

Microsoft Sentinel (KQL)