Akira Cloudflared Covert C2 Tunnel Service Installation (T1572)
Detects the installation and execution of the Cloudflare tunnel utility (cloudflared) as a Windows service. This behavior has been observed in Akira ransomware intrusions, where attackers use cloudflared to create a covert C2 tunnel and obscure RDP sessions by routing traffic through Cloudflare, effectively masking the true origin of connections to the compromised host.
Sigma
