NightEagle RDP Tunneling via Microsoft Dev Tunnels (devtunnels.ms)

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•1

This rule detects DNS queries and TLS SNI connections to 'devtunnels.ms'. This domain is associated with Microsoft Dev Tunnels, a service that exposes local development environments to the internet. Adversaries may abuse this legitimate service to establish reverse tunnels or proxies, enabling lateral movement and bypassing inbound network restrictions.