Windows Network Connections to Cloudflared Tunnel Domains
Alerts when a Windows process initiates outbound connections to Cloudflared tunnel domain hostnames.
- Product
- windows
- Category
- network_connection
- Author
- Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-05-27
- Updated
- 2026-07-31
ATT&CK techniques
C2 → ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule matches outbound network connections from a Windows host to Cloudflared tunnel-related domains when a connection is initiated by a local process. Such activity can indicate misuse of tunnel services to route command-and-control or enable remote access techniques like reverse shells. It relies on network connection telemetry containing the initiated flag and the destination hostname, specifically suffixes for Cloudflared tunnel domains.
Reporting behind it
- defr0ggy.github.iohttps://defr0ggy.github.io/research/Abusing-Cloudflared-A-Proxy-Service-To-Host-Share-Applications/
- guidepointsecurity.comhttps://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/
- Internal ResearchInternal Research
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_cloudflared_communication.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Network Connections to Cloudflared Tunnel Domains
id: cf1f5b9c-7da0-4e0c-8b73-535173545ce7
related:
- id: a1d9eec5-33b2-4177-8d24-27fe754d0812
type: derived
- id: 7cd1dcdc-6edf-4896-86dc-d1f19ad64903
type: derived
status: test
description: This rule matches outbound network connections from a Windows host to Cloudflared tunnel-related domains when a connection is initiated by a local process. Such activity can indicate misuse of tunnel services to route command-and-control or enable remote access techniques like reverse shells. It relies on network connection telemetry containing the initiated flag and the destination hostname, specifically suffixes for Cloudflared tunnel domains.
references:
- https://defr0ggy.github.io/research/Abusing-Cloudflared-A-Proxy-Service-To-Host-Share-Applications/
- https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_cloudflared_communication.yml
author: Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-05-27
tags:
- attack.exfiltration
- attack.command-and-control
- attack.t1567
- attack.t1572
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: "true"
DestinationHostname|endswith:
- .v2.argotunnel.com
- protocol-v2.argotunnel.com
- trycloudflare.com
- update.argotunnel.com
condition: selection
falsepositives:
- Legitimate use of cloudflare tunnels will also trigger this.
level: medium
license: DRL-1.1