Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Windows Potential Cloudflared Tunnel Execution

This analytic detects command-line arguments associated with the cloudflared client used to create Cloudflare tunnels. Cloudflared is functionally very similar to ngrok, an ingress-as-a-service tool. Cloudflared reaches out to the Cloudflare Edge Servers, creating an outbound connection over HTTPS(HTTP2/QUIC), where the tunnel's controller makes services or private networks accessible.

ATT&CK coverage

Outside the enterprise matrix

T1572

Detection requirements

Log source category: crowdstrike_processrollup2 sysmon_eventid_1 windows_event_log_security_4688

What the source says

What fires this without an attack behind it

Some legitimate use cases include authorized DevOps or IT teams using Cloudflared for secure remote access and network management. Filter alerts based on approved usage and trusted users.

References

Tagged by the source as

Reverse Network ProxyEndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.