OnyxC2 C2/delivery traffic correlated with known domains or suspicious sideloaded process
Correlates network connections to known OnyxC2 C2/delivery domains and Cloudflare-fronted IPs with the malware's sideloaded-process indicators to detect delivery and command-and-control traffic.
Microsoft Sentinel (KQL)
