Windows DNS Queries to Devtunnels .devtunnels.ms Domains
Alerts on Windows DNS queries for .devtunnels.ms domains, which may indicate DevTunnels-based C2 or persistence.
- Product
- windows
- Category
- dns_query
- Author
- citron_ninja (SigmaHQ), DRL 1.1
- Published
- 2023-10-25
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies DNS query events where the queried domain name ends with .devtunnels.ms. Such queries can indicate interaction with DevTunnels infrastructure, which attackers may leverage for remote access mechanisms like command-and-control or persistence. It relies on Windows DNS query telemetry that includes the queried name (QueryName) so the suffix match can be evaluated.
Reporting behind it
- blueteamops.medium.comhttps://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2
- learn.microsoft.comhttps://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security
- cydefops.comhttps://cydefops.com/devtunnels-unleashed
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_devtunnels_communication.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows DNS Queries to Devtunnels .devtunnels.ms Domains
id: f92f0a09-81bc-4793-8154-2eb4a21059af
related:
- id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4
type: similar
- id: 4b657234-038e-4ad5-997c-4be42340bce4
type: similar
- id: b3e6418f-7c7a-4fad-993a-93b65027a9f1
type: similar
- id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
type: derived
status: test
description: This rule identifies DNS query events where the queried domain name ends with .devtunnels.ms. Such queries can indicate interaction with DevTunnels infrastructure, which attackers may leverage for remote access mechanisms like command-and-control or persistence. It relies on Windows DNS query telemetry that includes the queried name (QueryName) so the suffix match can be evaluated.
references:
- https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2
- https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security
- https://cydefops.com/devtunnels-unleashed
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_devtunnels_communication.yml
author: citron_ninja, Huntrule Team
date: 2023-10-25
modified: 2023-11-20
tags:
- attack.command-and-control
- attack.t1071.001
- attack.t1572
logsource:
category: dns_query
product: windows
detection:
selection:
QueryName|endswith: .devtunnels.ms
condition: selection
falsepositives:
- Legitimate use of Devtunnels will also trigger this.
level: medium
license: DRL-1.1