Windows cloudflared Tunnel Cleanup Command Line Execution

title: Windows cloudflared Tunnel Cleanup Command Line Execution
id: 7dedfc57-b869-4d45-8399-9f8c1baf2734
status: test
description: Identifies Windows process creation where the command line includes the Cloudflared tunnel cleanup intent ("tunnel" and "cleanup") along with connector/config parameters. Attackers or administrators may use Cloudflared to manage tunnel connections, and cleanup activity can be used to remove traces or alter connectivity. The rule relies on process creation telemetry with full command-line content.
references:
  - https://github.com/cloudflare/cloudflared
  - https://developers.cloudflare.com/cloudflare-one/connections/connect-apps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cloudflared_tunnel_cleanup.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-17
modified: 2023-12-21
tags:
  - attack.command-and-control
  - attack.t1102
  - attack.t1090
  - attack.t1572
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - " tunnel "
      - "cleanup "
    CommandLine|contains:
      - "-config "
      - "-connector-id "
  condition: selection
falsepositives:
  - Legitimate usage of Cloudflared.
level: medium
license: DRL-1.1
related:
  - id: 7050bba1-1aed-454e-8f73-3f46f09ce56a
    type: derived