Windows: Execution of cloudflared.exe from Non-Standard Paths

title: "Windows: Execution of cloudflared.exe from Non-Standard Paths"
id: 4a578d83-ecdc-4294-90f2-cea6ce71fbe7
status: test
description: This rule flags process creation events where cloudflared.exe is launched from a path that does not include the expected installed locations under Program Files (x86)\cloudflared\ or Program Files\cloudflared\. Attackers can abuse portable or custom deployments of legitimate tooling to establish command-and-control or tunneling while blending in with known binaries. The detection relies on Windows process creation telemetry, specifically the executable image path ending in \cloudflared.exe and excluding those two standard installation paths.
references:
  - https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/
  - https://github.com/cloudflare/cloudflared
  - https://www.intrinsec.com/akira_ransomware/
  - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/
  - https://github.com/cloudflare/cloudflared/releases
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cloudflared_portable_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
tags:
  - attack.command-and-control
  - attack.t1090.001
date: 2023-12-20
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \cloudflared.exe
  filter_main_admin_location:
    Image|contains:
      - :\Program Files (x86)\cloudflared\
      - :\Program Files\cloudflared\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate usage of Cloudflared portable versions
level: medium
license: DRL-1.1
related:
  - id: fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd
    type: derived