Script Connection to Cloudflare Workers
Detects script engines (wscript.exe, mshta.exe, cscript.exe) making outbound network connections to Cloudflare Workers domains (*.workers.dev). This is a primary C2 channel utilized by Gamaredon for GammaLoad payload delivery and beaconing.
Microsoft Sentinel (KQL)
