ZOHOMURK C2/exfiltration via non-browser process contacting workdrive.zoho.com
Detects network connections to Zoho WorkDrive (workdrive.zoho.com) initiated by processes other than standard web browsers. This activity may indicate the use of unauthorized or automated tools to access cloud storage, potentially for data exfiltration or staging.
Microsoft Sentinel (KQL)
