All Detections

Cloudflared Tunnels Related DNS Requests

avatar
SigmaHQ Detections@sigmaHQ
updated Aug 14, 2025024

Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse this feature to establish a reverse shell or persistence on a machine.

Sigma