Windows Network Connections to *.devtunnels.ms

Alerts on initiated Windows network connections to .devtunnels.ms hostnames, which may indicate remote access use.

FreeReviewedSigma · Medium · v2

Product: windows
Category: network_connection
Author: Kamran Saifullah (SigmaHQ), DRL 1.1
Published: 2023-11-20
Updated: 2026-07-31

ATT&CK techniques

C2 → Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1572Protocol Tunneling
Exfiltration
- T1567.001Exfiltration to Code Repository
Impact

What it detects

This rule flags network connections initiated by a process where the destination hostname ends with .devtunnels.ms. Such connections can be abused by attackers to establish command-and-control style access, including reverse shells or persistence mechanisms via the DevTunnels infrastructure. It relies on Windows network connection telemetry with fields indicating whether the connection was initiated and the destination hostname.

Reporting behind it

Related detections9 linkedT1572 — drag to rearrange

Suspicious SCATTERED SPIDER Chisel Tunnel to Cloudflare Quick Tunnel (via process_creation)

Suspicious Cloudflared Tunnel Execution for Command and Control by Kraken Ransomware

Suspicious OpenSSH Reverse Tunnel Over HTTPS Port (Chaos Ransomware)

Possible Plink Reverse Tunnel Command Line Execution

Chisel Reverse Tunnel Tool Execution from Temporary Directory

Malicious Anubis Ransomware Cloudflare Tunnel via cloudflared (via process_creation)

Obfuscated RDP Tunneling Configuration Enabled for Port Forwarding (via process_creation)

Malicious RDP Tunneling (via rdp)

Suspicious SSH Reverse Tunnel via Renamed plink Utility on Triofox Host

Windows Network Connections to *.devtunnels.ms

Pivot detection · T1572 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-network-connections-to-devtunnels-ms-domains-9501f8e6

title: Windows Network Connections to *.devtunnels.ms
id: af8fa0aa-c2aa-4f57-8581-4a762a5149b6
related:
  - id: 4b657234-038e-4ad5-997c-4be42340bce4
    type: similar
  - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1
    type: similar
  - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
    type: similar
  - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4
    type: derived
status: test
description: This rule flags network connections initiated by a process where the destination hostname ends with .devtunnels.ms. Such connections can be abused by attackers to establish command-and-control style access, including reverse shells or persistence mechanisms via the DevTunnels infrastructure. It relies on Windows network connection telemetry with fields indicating whether the connection was initiated and the destination hostname.
references:
  - https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2
  - https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security
  - https://cydefops.com/devtunnels-unleashed
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_devtunnels.yml
author: Kamran Saifullah, Huntrule Team
date: 2023-11-20
tags:
  - attack.exfiltration
  - attack.command-and-control
  - attack.t1567.001
  - attack.t1572
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith: .devtunnels.ms
  condition: selection
falsepositives:
  - Legitimate use of Devtunnels will also trigger this.
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL