Explorer.exe Network Connection to Cloudflare Tunnel Domain
Detects instances where 'explorer.exe' initiates network connections to domains associated with Cloudflare Tunnel (trycloudflare.com). This behavior can indicate the use of tunneling software, potentially for malicious purposes such as command and control, data exfiltration, or bypassing network restrictions. While Cloudflare Tunnel has legitimate uses, its connection by 'explorer.exe' is unusual and warrants investigation.
CQL
