Windows execution of cloudflared.exe from a non-default directory
Alerts on cloudflared.exe executions from unusual paths on Windows, excluding standard Program Files locations.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-12-20
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags process creation events where cloudflared.exe is launched from a location other than the standard install paths under Program Files (x86)\cloudflared\ or Program Files\cloudflared\. Attackers may place portable binaries in alternate directories to blend in, evade allowlists, or control when and where the tunneling client runs. The detection relies on Windows process creation telemetry that includes the executed image path.
Reporting behind it
- developers.cloudflare.comhttps://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/
- github.comhttps://github.com/cloudflare/cloudflared
- intrinsec.comhttps://www.intrinsec.com/akira_ransomware/
- guidepointsecurity.comhttps://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/
- github.comhttps://github.com/cloudflare/cloudflared/releases
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cloudflared_portable_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows execution of cloudflared.exe from a non-default directory
id: 4a578d83-ecdc-4294-90f2-cea6ce71fbe7
status: test
description: This rule flags process creation events where cloudflared.exe is launched from a location other than the standard install paths under Program Files (x86)\cloudflared\ or Program Files\cloudflared\. Attackers may place portable binaries in alternate directories to blend in, evade allowlists, or control when and where the tunneling client runs. The detection relies on Windows process creation telemetry that includes the executed image path.
references:
- https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/
- https://github.com/cloudflare/cloudflared
- https://www.intrinsec.com/akira_ransomware/
- https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/
- https://github.com/cloudflare/cloudflared/releases
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cloudflared_portable_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
tags:
- attack.command-and-control
- attack.t1090.001
date: 2023-12-20
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \cloudflared.exe
filter_main_admin_location:
Image|contains:
- :\Program Files (x86)\cloudflared\
- :\Program Files\cloudflared\
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate usage of Cloudflared portable versions
level: medium
license: DRL-1.1
related:
- id: fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd
type: derived