Windows DNS Queries for Cloudflared Tunnel Domains

Alerts on Windows DNS queries for domains ending with common Cloudflared tunnel hostnames.

FreeReviewedSigma · Medium · v2

Product: windows
Category: dns_query
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-12-20
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
- T1572Protocol Tunneling
Exfiltration
Impact

What it detects

This rule flags DNS requests on Windows where the queried name ends with Cloudflared tunnel-related domains. Attackers may abuse these tunnels to support command-and-control activity, including establishing connectivity for remote access or persistence. It relies on DNS query telemetry containing the QueryName field to match the specified domain suffixes.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Suspicious UUID Named Pipe Created Consistent with Mythic SMB Agent

Windows DNS Queries to Devtunnels .devtunnels.ms Domains

Windows Process Execution of Common Tunneling Tools (httptunnel, plink, socat, stunnel)

Malicious Agent Tesla Loader Malformed User-Agent in HTTP Traffic (via proxy)

Malicious Interlock RAT FileFix Download-Cradle via PowerShell WebClient with PowerShell User-Agent (via ps_script)

Suspicious Cobalt Strike Malleable Profile Beaconing via Legacy MSIE9 User-Agent and IE Compatibility URIs (via proxy)

Suspicious SSH Reverse Tunnel Establishment (via process_creation)

Suspicious Cloudflared Tunnel Persistence Installed via msiexec (via process_creation)

Malicious Cobalt Strike Default Named Pipe Activity

Windows DNS Queries for Cloudflared Tunnel Domains

Pivot detection · T1071.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dns-queries-matching-cloudflared-tunnel-domains-a1d9eec5

title: Windows DNS Queries for Cloudflared Tunnel Domains
id: 683e03eb-e885-4c7a-b8d8-d04817c4491c
related:
  - id: 7cd1dcdc-6edf-4896-86dc-d1f19ad64903
    type: similar
  - id: a1d9eec5-33b2-4177-8d24-27fe754d0812
    type: derived
status: test
description: This rule flags DNS requests on Windows where the queried name ends with Cloudflared tunnel-related domains. Attackers may abuse these tunnels to support command-and-control activity, including establishing connectivity for remote access or persistence. It relies on DNS query telemetry containing the QueryName field to match the specified domain suffixes.
references:
  - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_cloudflared_communication.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-12-20
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.t1572
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryName|endswith:
      - .v2.argotunnel.com
      - protocol-v2.argotunnel.com
      - trycloudflare.com
      - update.argotunnel.com
  condition: selection
falsepositives:
  - Legitimate use of cloudflare tunnels will also trigger this.
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL