Cached Coder tar module files fetched during rogue registry window
Detects the creation of tar archives within the Coder database during a specific window associated with rogue IP activity, where the file creation was performed by a system-level process.
Microsoft Sentinel (KQL)
