Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Windows Devtunnels Execution

Detects the execution of Microsoft devtunnels.exe. Microsoft Devtunnels is a feature within Visual Studio that allows developers to expose their local development environment to the internet via secure, temporary tunnels, enabling external access for testing webhooks, APIs, and other services. While designed for legitimate development purposes, an attacker could exploit this feature to expose a compromised system or service to the internet, creating a covert communication channel that bypasses network security measures. By using Dev Tunnels, the attacker can establish a remote connection to the compromised environment, facilitate data exfiltration, or maintain command-and-control communications while avoiding detection by blending their activities with legitimate development traffic.

ATT&CK coverage

Outside the enterprise matrix

T1090

Detection requirements

Log source category: crowdstrike_processrollup2 sysmon_eventid_1 windows_event_log_security_4688

What the source says

What fires this without an attack behind it

Some legitimate developers may use Microsoft Devtunnels for testing and debugging their applications. Filter alerts for approved development environments and users.

References

https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2

Tagged by the source as

Reverse Network ProxyEndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.