AES-256 encrypted payload retrieval immediately following install-lure execution
Detects an encrypted/unsigned file download immediately following execution of a known OnyxC2 install-lure process (Setup_File*/Fling-Standalone* or a known lure hash), consistent with the AES-256-encrypted build/payload retrieval used to evade network content inspection.
Microsoft Sentinel (KQL)
