Network Connection Initiated To Cloudflared Tunnels Domains — Detection Rule
Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.