Windows Process Initiated Connections to .btunnel.co.in Domains

ATT&CK techniques

C2 → Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1572Protocol Tunneling
Exfiltration
- T1567Exfiltration Over Web Service
Impact

What it detects

This rule identifies network connections initiated by a local process to destinations ending with .btunnel.co.in on Windows. Such outbound tunneling domains can be abused to support command-and-control behaviors like remote access, reverse shells, or persistence. The detection relies on network connection telemetry that includes whether the connection was initiated and the destination hostname.

Reporting behind it

Related detections9 linkedT1572 — drag to rearrange

Windows Network Connections to Cloudflared Tunnel Domains

Windows Network Connections to Visual Studio Code Tunnels Domain

Linux network connections to ngrok tunneling endpoints

Windows Executable Initiating Connections to ngrok Tunnel Domains

Windows Process Initiated Connections to Ngrok Domains

Suspicious SCATTERED SPIDER Chisel Tunnel to Cloudflare Quick Tunnel (via process_creation)

Suspicious Cloudflared Tunnel Execution for Command and Control by Kraken Ransomware

Suspicious OpenSSH Reverse Tunnel Over HTTPS Port (Chaos Ransomware)

Possible Plink Reverse Tunnel Command Line Execution

Windows Process Initiated Connections to .btunnel.co.in Domains

Pivot detection · T1572 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-network-connections-to-btunnel-domains-9e02c8ec

title: Windows Process Initiated Connections to .btunnel.co.in Domains
id: bd3cce49-8d2f-4d68-8ee2-0146aa38ee82
status: test
description: This rule identifies network connections initiated by a local process to destinations ending with .btunnel.co.in on Windows. Such outbound tunneling domains can be abused to support command-and-control behaviors like remote access, reverse shells, or persistence. The detection relies on network connection telemetry that includes whether the connection was initiated and the destination hostname.
references:
  - https://defr0ggy.github.io/research/Utilizing-BTunnel-For-Data-Exfiltration/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_btunnels.yml
author: Kamran Saifullah, Huntrule Team
date: 2024-09-13
tags:
  - attack.exfiltration
  - attack.command-and-control
  - attack.t1567
  - attack.t1572
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith: .btunnel.co.in
  condition: selection
falsepositives:
  - Legitimate use of BTunnels will also trigger this.
level: medium
license: DRL-1.1
related:
  - id: 9e02c8ec-02b9-43e8-81eb-34a475ba7965
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL