Rule name: "Skopnix: Water Sigbin IP match"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [any]
  - and when any of Destination IP is contained in any of Reference Set - "Skopnix: Water Sigbin - IPs"
  - and NOT when an event matches any of the following BB:Skopnix Known-Good Exclusions
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix C2 match".
FP-safety: BB:Skopnix Known-Good Exclusions = RFC1918 + the customer's known-good destinations; the set only ever holds skopnix high-confidence, multi-source, warninglist-clean indicators (time-to-live 30 days, timeout on last seen).