Magento CMS block loader domains in database or web traffic
Detects process command lines containing Magento database audit strings (cms_block, cms_page) alongside specific loader domains, or network events communicating with these known loader domains.
Microsoft Sentinel (KQL)

