Cloudflared Portable Execution from Non-Standard Location
This rule detects the execution of the 'cloudflared.exe' binary from any location other than the standard installation paths ('Program Files (x86)\cloudflared\' or 'Program Files\cloudflared\'). Adversaries often use portable versions of legitimate tools like Cloudflared for command and control (C2) or data exfiltration, executing them from non-standard directories to evade detection. This behavior is frequently observed in ransomware campaigns, such as those by Akira, where Cloudflared is leveraged to establish tunnels for malicious traffic.
Sigma
