Protocol Tunneling — Command and Control via Cloudflared Quick Tunnel and Token-Based Cloudflare Tunnel

let LookbackWindow = 24h;
let TunnelBinaries = dynamic(["cloudflared.exe", "cloudflared"]);
let EdgeHosts = dynamic(["argotunnel.com", "trycloudflare.com", "cftunnel.com"]);
let ManagedPaths = dynamic([@"Program Files\cloudflared", @"Program Files (x86)\cloudflared", "/usr/local/bin/cloudflared", "/usr/bin/cloudflared"]);
let CliExecution =
    DeviceProcessEvents
    | where Timestamp > ago(LookbackWindow)
    | where FileName in~ (TunnelBinaries) or ProcessVersionInfoOriginalFileName =~ "cloudflared.exe"
    | where ProcessCommandLine has "tunnel" and (ProcessCommandLine has_any ("--url", "--token", "run", "service install"))
    | project Timestamp, DeviceId, DeviceName, Signal = "CliExecution", Detail = strcat(FolderPath, " | ", ProcessCommandLine);
let EdgeEgress =
    DeviceNetworkEvents
    | where Timestamp > ago(LookbackWindow)
    | where InitiatingProcessFileName in~ (TunnelBinaries) or RemoteUrl has_any (EdgeHosts) or RemotePort == 7844
    | where RemoteUrl has_any (EdgeHosts) or RemotePort == 7844
    | project Timestamp, DeviceId, DeviceName, Signal = "EdgeEgress", Detail = strcat(InitiatingProcessFileName, " -> ", RemoteUrl, ":", tostring(RemotePort));
let UnmanagedPath =
    DeviceProcessEvents
    | where Timestamp > ago(LookbackWindow)
    | where FileName in~ (TunnelBinaries) and ProcessCommandLine has "tunnel"
    | where not(FolderPath has_any (ManagedPaths))
    | project Timestamp, DeviceId, DeviceName, Signal = "UnmanagedPath", Detail = FolderPath;
union CliExecution, EdgeEgress, UnmanagedPath
| summarize EventCount = count(), SignalTypes = make_set(Signal), Details = make_set(Detail, 20), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName
| extend TunnelScore = array_length(SignalTypes)
| where TunnelScore >= 2
| project FirstSeen, LastSeen, DeviceName, DeviceId, TunnelScore, EventCount, SignalTypes, Details
| sort by TunnelScore desc, EventCount desc

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=3 OR EventCode=22)
| eval ImageLower=lower(coalesce(Image, "unknown"))
| eval CmdLower=lower(coalesce(CommandLine, ""))
| eval QueryLower=lower(coalesce(QueryName, ""))
| eval DestLower=lower(coalesce(DestinationHostname, ""))
| eval IsCli=if(EventCode==1 AND (like(ImageLower, "%\\cloudflared.exe") OR like(lower(coalesce(OriginalFileName,"")), "cloudflared.exe")) AND like(CmdLower, "%tunnel%") AND (like(CmdLower, "%--url%") OR like(CmdLower, "%--token%") OR like(CmdLower, "% run%") OR like(CmdLower, "%service install%")), 1, 0)
| eval IsUnmanagedPath=if(EventCode==1 AND like(ImageLower, "%\\cloudflared.exe") AND NOT like(ImageLower, "%\\program files%\\cloudflared\\%"), 1, 0)
| eval IsEdge=if((EventCode==22 AND (like(QueryLower, "%.argotunnel.com") OR like(QueryLower, "%.trycloudflare.com") OR like(QueryLower, "%.cftunnel.com"))) OR (EventCode==3 AND (DestinationPort=7844 OR like(DestLower, "%.argotunnel.com") OR like(DestLower, "%.trycloudflare.com"))), 1, 0)
| stats sum(IsCli) as CliEvents, sum(IsUnmanagedPath) as UnmanagedPathEvents, sum(IsEdge) as EdgeEvents, values(ImageLower) as ObservedImages, min(_time) as FirstSeen, max(_time) as LastSeen by ComputerName
| eval HasCli=if(CliEvents>0,1,0), HasUnmanaged=if(UnmanagedPathEvents>0,1,0), HasEdge=if(EdgeEvents>0,1,0)
| eval TunnelScore=HasCli+HasUnmanaged+HasEdge
| where TunnelScore>=2
| eval FirstSeen=strftime(FirstSeen, "%Y-%m-%d %H:%M:%S"), LastSeen=strftime(LastSeen, "%Y-%m-%d %H:%M:%S")
| table FirstSeen, LastSeen, ComputerName, TunnelScore, CliEvents, UnmanagedPathEvents, EdgeEvents, ObservedImages
| sort - TunnelScore

sequence by host.id with maxspan=15m
  [ process where event.type == "start" and
      (process.name : "cloudflared*" or process.pe.original_file_name : "cloudflared*") and
      process.args : "tunnel" and process.args : ("--url", "--token", "run", "install") ]
  [ network where event.type == "start" and
      process.name : "cloudflared*" and
      (destination.port == 7844 or destination.domain : ("*.argotunnel.com", "*.trycloudflare.com", "*.cftunnel.com")) ]

SELECT
    sourceip AS SourceIP,
    "Process Name" AS ProcessName,
    "Command" AS CommandLine,
    COUNT(*) AS EventCount,
    MIN(starttime) AS FirstSeen,
    MAX(starttime) AS LastSeen
FROM events
WHERE
    LOGSOURCETYPENAME(devicetype) = 'Microsoft Windows Security Event Log'
    AND "Process Name" ILIKE '%cloudflared.exe'
    AND "Command" ILIKE '%tunnel%'
    AND ("Command" ILIKE '%--url%' OR "Command" ILIKE '%--token%' OR "Command" ILIKE '% run%' OR "Command" ILIKE '%service install%')
    AND starttime > (NOW() - 86400000)
GROUP BY sourceip, "Process Name", "Command"
HAVING COUNT(*) >= 1
ORDER BY EventCount DESC

_sourceCategory=endpoint/sysmon EventID=1
| parse "Image=*," as image nodrop
| parse "CommandLine=*," as cmdline nodrop
| where image matches "*cloudflared.exe"
| where cmdline matches "*tunnel*"
| where (cmdline matches "*--url*" or cmdline matches "*--token*" or cmdline matches "* run*" or cmdline matches "*service install*")
| if (image matches "*Program Files*cloudflared*", 0, 1) as unmanaged_path
| count as CliEvents, sum(unmanaged_path) as UnmanagedPathEvents by host
| where CliEvents >= 1

rule cloudflared_quick_tunnel_c2 {
  meta:
    author = "Detection Engineering"
    description = "Detects cloudflared tunnel bootstrap (quick tunnel --url or token-based run/service install), a legitimate Cloudflare feature abused to expose a host and carry C2 over outbound-only TLS/QUIC."
    mitre_attack_tactic = "Command and Control"
    mitre_attack_technique = "T1572"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.target.process.file.full_path = /(?i)\\cloudflared(\.exe)?$|\/cloudflared$/
    $e.target.process.command_line = /(?i)tunnel.*(--url|--token|\brun\b|service install)/
    $host = $e.principal.hostname

  match:
    $host over 1h

  outcome:
    $tunnel_events = count($e.metadata.id)

  condition:
    $e and $tunnel_events >= 1
}

#event_simpleName = ProcessRollup2
| ImageFileName = /cloudflared(\.exe)?$/i
| CommandLine = /tunnel.*(--url|--token|\brun\b|service install)/i
| groupBy(
    [aid, ComputerName],
    function=[
      count(as=TunnelCliEvents),
      collect([ImageFileName, CommandLine], limit=5)
    ]
  )
| test(TunnelCliEvents >= 1)
| sort(field=TunnelCliEvents, order=desc)