Windows Process Creation: cloudflared Tunnel Execution with Config and Credentials Flags

Alerts on Windows processes running cloudflared tunnels with config and token/credential flags.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-05-17
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Windows process creation events where the command line contains the strings " tunnel " and " run " along with one or more Cloudflared-specific options such as "-config ", "-credentials-contents ", "-credentials-file ", or "-token ". Attackers can use cloudflared to establish inbound connectivity for remote access and persistence, so spotting these command-line patterns helps detect tunnel setup activity. It relies on process creation telemetry that includes the full command line for spawned processes.

Reporting behind it

Related detections9 linkedT1572 — drag to rearrange

Windows Network Connections to LocaltoNet/Localtonet Tunneling Subdomains

Linux: Network connections initiated to LocaltoNet tunneling subdomains

Windows: Detect cloudflared tunnel cleanup command execution

Linux network connections to ngrok tunneling endpoints

Windows Executable Initiating Connections to ngrok Tunnel Domains

Malicious Anubis Ransomware Cloudflare Tunnel via cloudflared (via process_creation)

Malicious QEMU Covert Network Tunnel via User-Mode netdev Socket (via process_creation)

Malicious Tunneling Tool Execution on Linux Host (via process_creation)

Suspicious Chisel Reverse Tunnel Execution by UAT-9686

Windows Process Creation: cloudflared Tunnel Execution with Config and Credentials Flags

Pivot detection · T1572 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-cloudflared-tunnel-execution-with-config-and-token-flag-9a019ffc

title: "Windows Process Creation: cloudflared Tunnel Execution with Config and Credentials Flags"
id: e830a6df-37a0-46bd-932c-e7f76bafbaf9
status: test
description: This rule matches Windows process creation events where the command line contains the strings " tunnel " and " run " along with one or more Cloudflared-specific options such as "-config ", "-credentials-contents ", "-credentials-file ", or "-token ". Attackers can use cloudflared to establish inbound connectivity for remote access and persistence, so spotting these command-line patterns helps detect tunnel setup activity. It relies on process creation telemetry that includes the full command line for spawned processes.
references:
  - https://blog.reconinfosec.com/emergence-of-akira-ransomware-group
  - https://github.com/cloudflare/cloudflared
  - https://developers.cloudflare.com/cloudflare-one/connections/connect-apps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cloudflared_tunnel_run.yml
author: Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-17
modified: 2023-12-20
tags:
  - attack.command-and-control
  - attack.t1102
  - attack.t1090
  - attack.t1572
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - " tunnel "
      - " run "
    CommandLine|contains:
      - "-config "
      - "-credentials-contents "
      - "-credentials-file "
      - "-token "
  condition: selection
falsepositives:
  - Legitimate usage of Cloudflared tunnel.
level: medium
license: DRL-1.1
related:
  - id: 9a019ffc-3580-4c9d-8d87-079f7e8d3fd4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL