Windows Network Connections to devtunnels.ms Domains

Alerts on initiated Windows network connections to .devtunnels.ms hostnames, which may indicate remote access use.

FreeUnreviewedSigmamediumv1

windows-network-connections-to-devtunnels-ms-domains-9501f8e6

title: Windows Network Connections to devtunnels.ms Domains
id: af8fa0aa-c2aa-4f57-8581-4a762a5149b6
related:
  - id: 4b657234-038e-4ad5-997c-4be42340bce4
    type: similar
  - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1
    type: similar
  - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
    type: similar
  - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4
    type: derived
status: test
description: This rule flags Windows network_connection events where the connection was initiated and the destination hostname ends with .devtunnels.ms. Such connections can be abused to establish remote access pathways, including reverse shell or persistence. It relies on telemetry that includes connection initiation status and the destination hostname observed in Windows network connection logs.
references:
  - https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2
  - https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security
  - https://cydefops.com/devtunnels-unleashed
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_devtunnels.yml
author: Kamran Saifullah, Huntrule Team
date: 2023-11-20
tags:
  - attack.exfiltration
  - attack.command-and-control
  - attack.t1567.001
  - attack.t1572
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith: .devtunnels.ms
  condition: selection
falsepositives:
  - Legitimate use of Devtunnels will also trigger this.
level: medium
license: DRL-1.1

What it detects

This rule flags Windows network_connection events where the connection was initiated and the destination hostname ends with .devtunnels.ms. Such connections can be abused to establish remote access pathways, including reverse shell or persistence. It relies on telemetry that includes connection initiation status and the destination hostname observed in Windows network connection logs.

Known false positives

Legitimate use of Devtunnels will also trigger this.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.