Network Beaconing to Slopoly/Hive0163 C2 via Known IP or Cloudflare Tunnels
Detects network connections to a specific suspicious IP address (94.156.181.89) or to domains associated with Cloudflare Tunnel (.trycloudflare.com). This could indicate command and control activity, data exfiltration, or other malicious network communication.
Microsoft Sentinel (KQL)
