Windows: Detect cloudflared tunnel cleanup command execution

Flags Windows executions of cloudflared with tunnel cleanup and connector/config parameters.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-05-17
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches process executions where the command line includes the cloudflared tunnel cleanup operation and related parameters for configuration and connector identification. Cleanup behavior can indicate attempts to remove or reset tunnel state, which may be used during operational changes, redeployments, or evasive activity. Telemetry relies on Windows process creation events that capture full command-line arguments.

Reporting behind it

Related detections9 linkedT1572 — drag to rearrange

Windows Network Connections to LocaltoNet/Localtonet Tunneling Subdomains

Linux: Network connections initiated to LocaltoNet tunneling subdomains

Windows Process Creation: cloudflared Tunnel Execution with Config and Credentials Flags

Linux network connections to ngrok tunneling endpoints

Windows Executable Initiating Connections to ngrok Tunnel Domains

Malicious Anubis Ransomware Cloudflare Tunnel via cloudflared (via process_creation)

Malicious QEMU Covert Network Tunnel via User-Mode netdev Socket (via process_creation)

Malicious Tunneling Tool Execution on Linux Host (via process_creation)

Suspicious Chisel Reverse Tunnel Execution by UAT-9686

Windows: Detect cloudflared tunnel cleanup command execution

Pivot detection · T1572 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-cloudflared-tunnel-cleanup-command-line-execution-7050bba1

title: "Windows: Detect cloudflared tunnel cleanup command execution"
id: 7dedfc57-b869-4d45-8399-9f8c1baf2734
status: test
description: This rule matches process executions where the command line includes the cloudflared tunnel cleanup operation and related parameters for configuration and connector identification. Cleanup behavior can indicate attempts to remove or reset tunnel state, which may be used during operational changes, redeployments, or evasive activity. Telemetry relies on Windows process creation events that capture full command-line arguments.
references:
  - https://github.com/cloudflare/cloudflared
  - https://developers.cloudflare.com/cloudflare-one/connections/connect-apps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cloudflared_tunnel_cleanup.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-17
modified: 2023-12-21
tags:
  - attack.command-and-control
  - attack.t1102
  - attack.t1090
  - attack.t1572
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - " tunnel "
      - "cleanup "
    CommandLine|contains:
      - "-config "
      - "-connector-id "
  condition: selection
falsepositives:
  - Legitimate usage of Cloudflared.
level: medium
license: DRL-1.1
related:
  - id: 7050bba1-1aed-454e-8f73-3f46f09ce56a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL