CLEANGULP beacon registration to typosquat C2 thecovnresation[.]com/.net
Detects network connection attempts to known typosquatted domains (thecovnresation.com/net) commonly associated with the CLEANGULP malware beaconing activity, specifically targeting the /beacon/pre-register URI path.
Microsoft Sentinel (KQL)
