Cloudflared Portable Execution

Title: Cloudflared Portable Execution
Status: test
Description:Detects the execution of the "cloudflared" binary from a non standard location.
References:
  -https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/
  -https://github.com/cloudflare/cloudflared
  -https://www.intrinsec.com/akira_ransomware/
  -https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/
  -https://github.com/cloudflare/cloudflared/releases
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-12-20
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.t1090.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\cloudflared.exe'
  filter_main_admin_location:
    Image|contains:
      -':\Program Files (x86)\cloudflared\'
      -':\Program Files\cloudflared\'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Legitimate usage of Cloudflared portable versions
Level: medium