Vidar - RegAsm.exe Initiating Telegram/Cloudflare Proxy Connection
Detects when RegAsm.exe initiates outbound HTTPS connections to domains associated with Telegram or Cloudflare. This behavior is indicative of malware like Vidar using RegAsm.exe for network communication, potentially for command and control or data exfiltration, leveraging legitimate services as proxies.
Microsoft Sentinel (KQL)
