Windows DNS Queries Matching Cloudflared Tunnel Domains

Alerts on Windows DNS queries for domains ending with common Cloudflared tunnel hostnames.

FreeUnreviewedSigmamediumv1

windows-dns-queries-matching-cloudflared-tunnel-domains-a1d9eec5

title: Windows DNS Queries Matching Cloudflared Tunnel Domains
id: 683e03eb-e885-4c7a-b8d8-d04817c4491c
related:
  - id: 7cd1dcdc-6edf-4896-86dc-d1f19ad64903
    type: similar
  - id: a1d9eec5-33b2-4177-8d24-27fe754d0812
    type: derived
status: test
description: This rule flags DNS query names that end with known Cloudflared tunnel-related domains. Such traffic can indicate attempt(s) to use tunnel functionality for command-and-control, including enabling remote access or persistence. It relies on Windows DNS query telemetry containing the queried domain name.
references:
  - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_cloudflared_communication.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-12-20
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.t1572
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryName|endswith:
      - .v2.argotunnel.com
      - protocol-v2.argotunnel.com
      - trycloudflare.com
      - update.argotunnel.com
  condition: selection
falsepositives:
  - Legitimate use of cloudflare tunnels will also trigger this.
level: medium
license: DRL-1.1

What it detects

This rule flags DNS query names that end with known Cloudflared tunnel-related domains. Such traffic can indicate attempt(s) to use tunnel functionality for command-and-control, including enabling remote access or persistence. It relies on Windows DNS query telemetry containing the queried domain name.

Known false positives

Legitimate use of cloudflare tunnels will also trigger this.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.