Windows DNS Queries to Devtunnels (.devtunnels.ms)

Alerts on Windows DNS queries for .devtunnels.ms domains, which may indicate DevTunnels-based C2 or persistence.

FreeUnreviewedSigmamediumv1

windows-dns-queries-to-devtunnels-devtunnels-ms-1cb0c6ce

title: Windows DNS Queries to Devtunnels (.devtunnels.ms)
id: f92f0a09-81bc-4793-8154-2eb4a21059af
related:
  - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4
    type: similar
  - id: 4b657234-038e-4ad5-997c-4be42340bce4
    type: similar
  - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1
    type: similar
  - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
    type: derived
status: test
description: This rule flags Windows systems making DNS queries for domains ending in .devtunnels.ms. Adversaries may leverage DevTunnels functionality to support command-and-control activity such as reverse connectivity or persistence. It relies on DNS query telemetry that includes the queried domain name.
references:
  - https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2
  - https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security
  - https://cydefops.com/devtunnels-unleashed
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_devtunnels_communication.yml
author: citron_ninja, Huntrule Team
date: 2023-10-25
modified: 2023-11-20
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.t1572
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryName|endswith: .devtunnels.ms
  condition: selection
falsepositives:
  - Legitimate use of Devtunnels will also trigger this.
level: medium
license: DRL-1.1

What it detects

This rule flags Windows systems making DNS queries for domains ending in .devtunnels.ms. Adversaries may leverage DevTunnels functionality to support command-and-control activity such as reverse connectivity or persistence. It relies on DNS query telemetry that includes the queried domain name.

Known false positives

Legitimate use of Devtunnels will also trigger this.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.