Suspicious Tunneling Activity Detected

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•9

This rule detects suspicious process command lines that indicate potential tunneling activity. It looks for commands containing 'tunnel', '--url', and '--logfile', while excluding legitimate 'cloudflared.exe' processes. This pattern is often used by adversaries to establish covert communication channels or exfiltrate data.