NightEagle Outbound Connection to Microsoft Dev Tunnels (devtunnels.ms)

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•2

This rule detects established outbound network connections to 'devtunnels.ms', which is a legitimate service often abused by adversaries to tunnel RDP traffic and bypass network security controls or firewall restrictions. This behavior is indicative of unauthorized remote access setup.