N-able N-central — published mitigation IOCs (Cloudflared service + svchost.exe in Documents)
This rule detects two potentially malicious behaviors: 1) The creation or installation of a Windows service using the 'Cloudflared' executable, which can be leveraged for unauthorized tunneling or persistence. 2) The execution of an executable named 'svchost.exe' located within a user's Documents folder, which is a common indicator of file masquerading to evade detection.
Microsoft Sentinel (KQL)
