Windows DNS Queries for Cloudflared Tunnel Domains

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
- T1572Protocol Tunneling
Exfiltration
Impact

What it detects

This rule flags DNS requests on Windows where the queried name ends with Cloudflared tunnel-related domains. Attackers may abuse these tunnels to support command-and-control activity, including establishing connectivity for remote access or persistence. It relies on DNS query telemetry containing the QueryName field to match the specified domain suffixes.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Windows DNS Queries to Devtunnels .devtunnels.ms Domains

Windows Process Execution of Common Tunneling Tools (httptunnel, plink, socat, stunnel)

Suspicious SCATTERED SPIDER Chisel Tunnel to Cloudflare Quick Tunnel (via process_creation)

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious BadIIS C2 Communication via lwxatisme User-Agent

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

Suspicious WarmCookie C2 Beacon With Fixed Firefox User-Agent

Suspicious Cloudflared Tunnel Execution for Command and Control by Kraken Ransomware

Windows DNS Queries for Cloudflared Tunnel Domains

Pivot detection · T1071.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dns-queries-matching-cloudflared-tunnel-domains-a1d9eec5

title: Windows DNS Queries for Cloudflared Tunnel Domains
id: 683e03eb-e885-4c7a-b8d8-d04817c4491c
related:
  - id: 7cd1dcdc-6edf-4896-86dc-d1f19ad64903
    type: similar
  - id: a1d9eec5-33b2-4177-8d24-27fe754d0812
    type: derived
status: test
description: This rule flags DNS requests on Windows where the queried name ends with Cloudflared tunnel-related domains. Attackers may abuse these tunnels to support command-and-control activity, including establishing connectivity for remote access or persistence. It relies on DNS query telemetry containing the QueryName field to match the specified domain suffixes.
references:
  - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_cloudflared_communication.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-12-20
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.t1572
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryName|endswith:
      - .v2.argotunnel.com
      - protocol-v2.argotunnel.com
      - trycloudflare.com
      - update.argotunnel.com
  condition: selection
falsepositives:
  - Legitimate use of cloudflare tunnels will also trigger this.
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL