OnyxC2 DNS/HTTP beaconing to suspicious TLDs and known domains
Detects DNS/HTTP beaconing to known OnyxC2 domains or suspicious top-level domains (.top, .cyou, .lol, .online) initiated by a non-browser or newly-created process, plus correlated network-IDS alerts.
Microsoft Sentinel (KQL)
