Cloudflared Tunnel Installed via PowerShell for C2 (Akira/BumbleBee)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects the use of PowerShell to invoke or interact with 'cloudflared', a tool used to create secure tunnels to Cloudflare. This behavior is often associated with the deployment of malicious infrastructure or remote access tunnels for command and control purposes.