Possible DNS Query To Devtunnels Domain (via dns_query)

title: Possible DNS Query To Devtunnels Domain (via dns_query)
id: b588c408-00e0-503f-b911-da94fd5bcec5
status: stable
description: This rule detects DNS query requests to Devtunnels domains. Adversaries can misuse that feature to establish a reverse shell or persistence on a machine.
references:
    - https://attack.mitre.org/techniques/T1572/
    - https://attack.mitre.org/techniques/T1071/001/
    - https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2
    - https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security
    - https://cydefops.com/devtunnels-unleashed
author: Huntrule Team
date: 2026-06-16
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1572
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName|endswith: '.devtunnels.ms'
    condition: selection
falsepositives:
    - Unknown
level: medium