Cloudflared Quick Tunnel Execution
Detects the execution of the Cloudflared Quick Tunnel utility, which can be used by adversaries to establish tunnels for various services like HTTP, RDP, SSH, and SMB. This tool has been observed in use by threat groups, including Akira ransomware, to create ad-hoc tunnels that generate random subdomains on trycloudflare.com.
Sigma
