Windows Process Network Connections to Cloudflared Tunnel Domains

Alerts when a Windows process initiates outbound connections to Cloudflared tunnel domain hostnames.

FreeUnreviewedSigmamediumv1

windows-process-network-connections-to-cloudflared-tunnel-domains-7cd1dcdc

title: Windows Process Network Connections to Cloudflared Tunnel Domains
id: cf1f5b9c-7da0-4e0c-8b73-535173545ce7
related:
  - id: a1d9eec5-33b2-4177-8d24-27fe754d0812
    type: derived
  - id: 7cd1dcdc-6edf-4896-86dc-d1f19ad64903
    type: derived
status: test
description: This rule flags outbound network connections initiated by a process on Windows where the destination hostname ends with Cloudflared tunnel-related domains such as .v2.argotunnel.com, protocol-v2.argotunnel.com, trycloudflare.com, or update.argotunnel.com. Abnormal use of Cloudflared tunnels can enable command-and-control or remote access pathways for an attacker. The detection relies on network connection telemetry that includes whether the connection was initiated and the destination hostname.
references:
  - https://defr0ggy.github.io/research/Abusing-Cloudflared-A-Proxy-Service-To-Host-Share-Applications/
  - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_cloudflared_communication.yml
author: Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-05-27
tags:
  - attack.exfiltration
  - attack.command-and-control
  - attack.t1567
  - attack.t1572
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith:
      - .v2.argotunnel.com
      - protocol-v2.argotunnel.com
      - trycloudflare.com
      - update.argotunnel.com
  condition: selection
falsepositives:
  - Legitimate use of cloudflare tunnels will also trigger this.
level: medium
license: DRL-1.1

What it detects

This rule flags outbound network connections initiated by a process on Windows where the destination hostname ends with Cloudflared tunnel-related domains such as .v2.argotunnel.com, protocol-v2.argotunnel.com, trycloudflare.com, or update.argotunnel.com. Abnormal use of Cloudflared tunnels can enable command-and-control or remote access pathways for an attacker. The detection relies on network connection telemetry that includes whether the connection was initiated and the destination hostname.

Known false positives

Legitimate use of cloudflare tunnels will also trigger this.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.