Rule Info
Name
Cloudflared Tunnel Connections Cleanup
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.
Date
2023-05-17 00:00:00
Modified
2023-12-21 00:00:00
Id
7050bba1-1aed-454e-8f73-3f46f09ce56a
Tags
attack.command_and_control attack.t1102 attack.t1090 attack.t1572 DEMO
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR