Outbound Microsoft Dev Tunnel Traffic Indicating RDP Redirection (NightEagle)

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•2

Detects DNS queries and established TLS connections to Microsoft Dev Tunnels (devtunnels.ms), which can be abused by adversaries to establish tunnels for unauthorized remote access, such as tunneling RDP traffic to bypass network security controls.