Whisper Security - C2 Communication Detection

Original query, unchanged.

// MITRE ATT&CK: T1071 - Application Layer Protocol
// Tactic: Command and Control
// Detects C2 communication by correlating network logs with Whisper threat intel
let timeRange = 1h;
let threatThreshold = 60;
let c2Indicators = WhisperThreatIntel_CL
    | where TimeGenerated > ago(timeRange)
    | where isC2 == true
    | where threatScore > threatThreshold
    | project indicator, threatScore, threatLevel, feedNames, explanation, lastSeen;
let CommonSecurityLogSafe = union isfuzzy=true CommonSecurityLog, (datatable(TimeGenerated:datetime, DestinationIP:string, DestinationHostName:string, SourceIP:string, DeviceProduct:string, DeviceAction:string)[]);
CommonSecurityLogSafe
    | where TimeGenerated > ago(timeRange)
    | where isnotempty(DestinationIP) or isnotempty(DestinationHostName)
    | extend matchIndicator = coalesce(DestinationHostName, DestinationIP)
    | join kind=inner (c2Indicators) on $left.matchIndicator == $right.indicator
    | extend SourceIP = SourceIP, DestinationIP = DestinationIP, DnsDomain = DestinationHostName
    | project TimeGenerated, SourceIP, DestinationIP, DnsDomain, DeviceProduct, DeviceAction, threatScore, threatLevel, feedNames, explanation