Potential TryCloudflare Tunnel Misuse via Scripting
Detects potential misuse of TryCloudflare tunnels for malware delivery or C2 communication by monitoring command-line arguments of common scripting and download tools. Adversaries leverage legitimate services like TryCloudflare to host malicious payloads and evade detection.
Sigma
