huntrule

Windows: Detect cloudflared tunnel cleanup command execution

Flags Windows executions of cloudflared with tunnel cleanup and connector/config parameters.

FreeReviewedSigma · Medium · v2
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-05-17
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule matches process executions where the command line includes the cloudflared tunnel cleanup operation and related parameters for configuration and connector identification. Cleanup behavior can indicate attempts to remove or reset tunnel state, which may be used during operational changes, redeployments, or evasive activity. Telemetry relies on Windows process creation events that capture full command-line arguments.

Reporting behind it

Related detections9 linkedT1572 — drag to rearrange
Windows Network Connections to LocaltoNet/Localtonet Tunneling Subdomains
Linux: Network connections initiated to LocaltoNet tunneling subdomains
Windows Process Creation: cloudflared Tunnel Execution with Config and Credentials Flags
Linux network connections to ngrok tunneling endpoints
Windows Executable Initiating Connections to ngrok Tunnel Domains
Malicious Anubis Ransomware Cloudflare Tunnel via cloudflared (via process_creation)
Malicious QEMU Covert Network Tunnel via User-Mode netdev Socket (via process_creation)
Malicious Tunneling Tool Execution on Linux Host (via process_creation)
Suspicious Chisel Reverse Tunnel Execution by UAT-9686
Windows: Detect cloudflared tunnel cleanup command execution
Pivot detection · T1572 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.