Rule Info
Name
Network Connection Initiated To DevTunnels Domain
Author
Kamran Saifullah
Description
Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Date
2023-11-20 00:00:00
Modified
None
Id
9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4
Tags
attack.exfiltration attack.t1567.001
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
github-actions[bot]
Merge PR #5027 from @nasbench - Promote older rules status from `experimental` to `test`
2024-10-01
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
Nasreddine Bencherchali
Merge PR #4702 from @nasbench - Rule tuning and updates
2024-02-12
Kamran Saifullah - Frog Man
Merge PR #4580 from @deFr0ggy - Update VsCode/DevTunnels Communication Related Rules
2023-11-20
Scan your endpoints, forensic images or collected files with our portable scanner THOR