Cloudflared Tunnel Connections Cleanup

Title: Cloudflared Tunnel Connections Cleanup
Status: test
Description:Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.
References:
  -https://github.com/cloudflare/cloudflared
  -https://developers.cloudflare.com/cloudflare-one/connections/connect-apps
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-17
modified:2023-12-21
Tags:

• -'attack.command-and-control'
• -'attack.t1102'
• -'attack.t1090'
• -'attack.t1572'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains|all:
      -' tunnel '
      -'cleanup '

    CommandLine|contains:
      -'-config '
      -'-connector-id '

  condition:selection
Falsepositives:
  -Legitimate usage of Cloudflared.
Level: medium