Cloudflared Tunnel Connections Cleanup
Detects the execution of the "cloudflared" tool with the "tunnel cleanup" command. This command is used to remove Cloudflare Tunnel connections, which could be an indicator of an adversary attempting to remove traces of their C2 infrastructure or clean up after an operation. The rule looks for specific command-line arguments including 'tunnel', 'cleanup', and either '-config' or '-connector-id'.
Sigma
