Suspicious Process DNS Query for TryCloudflare
Detects DNS queries for subdomains of 'trycloudflare.com' originating from suspicious processes, such as script interpreters and LOLBins. Attackers, such as those behind the VOID#GEIST campaign, leverage Cloudflare Tunnels to host command and control (C2) infrastructure, and initiating these connections from script interpreters or LOLBins is a common TTP.
Sigma
