Lure page canvas-fingerprinting domain contacted prior to OnyxC2 dropper registry modification
Detects contact with the OnyxC2 lure landing page performing canvas fingerprinting (multiboardthe.com) correlated with a subsequent registry write from the known dropper process, tying victim-vetting to the OnyxC2 install chain.
Microsoft Sentinel (KQL)
