Query

DeviceNetworkEvents
| where RemoteUrl has_any ("trycloudflare", "argotunnel.com")

About this query

Rule : Detection of Cloudflared Argo Tunnel Communication

Description

This detection rule identifies network communication to Cloudflared Argo Tunnel services, specifically targeting trycloudflare and argotunnel.com domains. Cloudflared is a legitimate tool used to securely tunnel traffic through Cloudflare's network, often for web applications and remote access. However, adversaries can abuse Argo Tunnels to bypass network security controls, establish covert communication channels, and exfiltrate data without detection.

This rule helps detect potential misuse of Cloudflared tunneling services by monitoring outbound DNS queries to trycloudflare and argotunnel.com.

Sigma Rule: DNS Query for Cloudflared Communication

Detection Logic

Monitors DeviceNetworkEvents for DNS queries or network requests where:
- The RemoteUrl contains "trycloudflare" or "argotunnel.com".

Search Query

Explanation

This query is designed to detect suspicious network activity related to Cloudflared Argo Tunnel services. Cloudflared is a tool that allows secure tunneling of traffic through Cloudflare's network, which can be used for legitimate purposes like web applications and remote access. However, it can also be misused by attackers to bypass security measures and secretly communicate or transfer data.

The query specifically looks for any DNS queries or network requests that involve the domains "trycloudflare" or "argotunnel.com". By monitoring these outbound requests, the rule aims to identify potential misuse of Cloudflared tunneling services, which could indicate covert communication or data exfiltration attempts.

In simple terms, this query helps detect when someone might be using Cloudflared to secretly send or receive data over the network, potentially indicating malicious activity.

KQL Search