Renamed Cloudflared.EXE Execution
This rule detects the execution of the 'cloudflared' binary when it has been renamed. It looks for specific command-line arguments associated with Cloudflare Tunnel operations ('tunnel cleanup', 'tunnel run', '-url tunnel') in conjunction with a list of known SHA256 hashes for legitimate cloudflared executables. The rule triggers if these conditions are met and the executable's name is NOT one of the known legitimate 'cloudflared.exe' names, indicating a potential attempt to disguise its execution.
Sigma
