Cloudflare Tunnel utility running outside standard installation paths or spawned by web/script parents

Ankit Mehta@Secvyn

•updated Aug 5, 2026•4•0•2

This rule detects the execution of the Cloudflare Tunnel utility (cloudflared.exe) or similarly named binaries from non-standard, suspicious locations like temporary directories or public user folders. This pattern is commonly used by attackers to establish unauthorized persistent network tunnels (reverse proxies) into the victim's environment, bypassing firewall restrictions.