Windows Network Connections to *.devtunnels.ms

Alerts on initiated Windows network connections to .devtunnels.ms hostnames, which may indicate remote access use.

FreeReviewedSigma · Medium · v2

Product: windows
Category: network_connection
Author: Kamran Saifullah (SigmaHQ), DRL 1.1
Published: 2023-11-20
Updated: 2026-07-31

ATT&CK techniques

C2 → Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1572Protocol Tunneling
Exfiltration
- T1567.001Exfiltration to Code Repository
Impact

What it detects

This rule flags network connections initiated by a process where the destination hostname ends with .devtunnels.ms. Such connections can be abused by attackers to establish command-and-control style access, including reverse shells or persistence mechanisms via the DevTunnels infrastructure. It relies on Windows network connection telemetry with fields indicating whether the connection was initiated and the destination hostname.

Reporting behind it

Related detections9 linkedT1572 — drag to rearrange

Suspicious SSH Reverse Tunnel Establishment (via process_creation)

Suspicious Cloudflared Tunnel Persistence Installed via msiexec (via process_creation)

Suspicious Renamed Tunneling Tool Executing from Windows Tasks Directory

Suspicious Reverse SSH Tunnel Creation with Host Key Verification Disabled (via process_creation)

Malicious Abyss Locker wmihelper SSH Backdoor Deployment (via file_event)

Malicious GS-Netcat Command and Control via Global Socket Relay Network (via dns_query)

Suspicious Microsoft Dev Tunnel Domain Resolution via DNS (via dns_query)

Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs

Suspicious SSH Reverse Tunnel Over DNS Port

Windows Network Connections to *.devtunnels.ms

Pivot detection · T1572 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-network-connections-to-devtunnels-ms-domains-9501f8e6

title: Windows Network Connections to *.devtunnels.ms
id: af8fa0aa-c2aa-4f57-8581-4a762a5149b6
related:
  - id: 4b657234-038e-4ad5-997c-4be42340bce4
    type: similar
  - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1
    type: similar
  - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
    type: similar
  - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4
    type: derived
status: test
description: This rule flags network connections initiated by a process where the destination hostname ends with .devtunnels.ms. Such connections can be abused by attackers to establish command-and-control style access, including reverse shells or persistence mechanisms via the DevTunnels infrastructure. It relies on Windows network connection telemetry with fields indicating whether the connection was initiated and the destination hostname.
references:
  - https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2
  - https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security
  - https://cydefops.com/devtunnels-unleashed
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_devtunnels.yml
author: Kamran Saifullah, Huntrule Team
date: 2023-11-20
tags:
  - attack.exfiltration
  - attack.command-and-control
  - attack.t1567.001
  - attack.t1572
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith: .devtunnels.ms
  condition: selection
falsepositives:
  - Legitimate use of Devtunnels will also trigger this.
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL