Network Connection Initiated To DevTunnels Domain

SigmaHQ Detections@sigmaHQ

•updated Jul 30, 2025•1•0•21

Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.