Windows Process Creation: cloudflared Tunnel Execution with Config and Token Flags

title: "Windows Process Creation: cloudflared Tunnel Execution with Config and Token Flags"
id: e830a6df-37a0-46bd-932c-e7f76bafbaf9
status: test
description: This rule flags Windows process executions whose command line contains both “tunnel” and “run” along with tunnel setup flags such as “-config” and credential/token parameters. Attackers may use Cloudflared to create outbound connectivity for remote access and persistence by establishing a tunnel from a compromised host. The detection relies on process creation telemetry with access to the full command line arguments.
references:
  - https://blog.reconinfosec.com/emergence-of-akira-ransomware-group
  - https://github.com/cloudflare/cloudflared
  - https://developers.cloudflare.com/cloudflare-one/connections/connect-apps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cloudflared_tunnel_run.yml
author: Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-17
modified: 2023-12-20
tags:
  - attack.command-and-control
  - attack.t1102
  - attack.t1090
  - attack.t1572
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - " tunnel "
      - " run "
    CommandLine|contains:
      - "-config "
      - "-credentials-contents "
      - "-credentials-file "
      - "-token "
  condition: selection
falsepositives:
  - Legitimate usage of Cloudflared tunnel.
level: medium
license: DRL-1.1
related:
  - id: 9a019ffc-3580-4c9d-8d87-079f7e8d3fd4
    type: derived