Cloudflared C2 Tunnel Installed as Persistent Service via PowerShell Download
Detects the installation of 'cloudflared.exe' as a Windows service from a non-standard file path. The rule specifically correlates this service installation with preceding PowerShell commands typically used to download remote files, consistent with tradecraft observed in Akira and Bumblebee campaigns to establish covert C2 tunneling.
Microsoft Sentinel (KQL)
