Network Connection Initiated To Cloudflared Tunnels Domains

SigmaHQ Detections@sigmaHQ

•updated Jul 30, 2025•2•0•20

Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse this feature to establish a reverse shell or persistence on a machine.