APT41 ToughProgress C2 Outbound Connection to Cloudflare/Infinity Domains
This rule monitors network connection events for outbound traffic to known tunneling, development, and hosting platforms often abused by adversaries for command and control or unauthorized data egress. The rule specifically excludes common browsers, development tools, and package managers to focus on unexpected processes initiating these connections.
Microsoft Sentinel (KQL)
