Renamed Cloudflare Tunnel Execution

Kaung Khant Ko@kaungkhantko

•updated Jun 17, 2026•3•0•64

Detects the execution of a Cloudflare tunnel (cloudflared) binary that has been renamed to evade detection (e.g., svchost.exe), commonly used to establish persistent C2 tunnels.