The cloudflared agent opens outbound connections to Cloudflare’s edge and publishes internal services through it. That is a legitimate product, and it is also a convenient way for an operator to expose RDP, SSH or a web shell with no inbound rule and no server of their own. The destination IP ranges are Cloudflare’s, so we detect the agent, its token and its quick-tunnel hostnames.
Signals at a Glance
| Signal | Where | ATT&CK |
|---|---|---|
| cloudflared tunnel run with --token, or tunnel --url for a quick tunnel | Sysmon 1, 4688, auditd, EDR | T1572 |
| DNS or proxy requests to trycloudflare.com | DNS, proxy | T1090 |
| Outbound TCP or UDP 7844 to Cloudflare edge addresses | Firewall, Zeek conn.log | T1572 |
| Queries for regionN.v2.argotunnel.com | DNS, EDR | T1090 |
| cloudflared installed as a service on a host with no approved use | Service install 7045, systemd | T1543.003 |
Agent Execution and Services
A tunnel is created either with a long account token (a named tunnel) or with --url for an ephemeral quick tunnel that needs no account. Both are visible in the command line, and the token form is what persistence wrappers use. Alert on both and treat the service installation as an escalation:
title: cloudflared Tunnel Execution
logsource:
category: process_creation
detection:
selection_img:
Image|endswith:
- '\cloudflared.exe'
- '/cloudflared'
selection_args:
CommandLine|contains:
- 'tunnel run'
- '--token'
- 'tunnel --url'
- 'service install'
condition: selection_img and selection_args
level: medium
# tune/validate: raise to high on servers and domain controllers; allow-list
# hosts where your platform team deliberately runs Cloudflare Tunnel.
Edge Egress and Quick Tunnels
The agent connects out on port 7844 to regional edge names under argotunnel.com. Quick tunnels publish random hostnames under trycloudflare.com. Since the edge is shared infrastructure, key on the name and the port rather than on the IP:
# Splunk (Zeek conn.log + dns.log) - Cloudflare Tunnel signals
(index=zeek sourcetype=bro_dns (query="*.trycloudflare.com" OR query="*.argotunnel.com"))
OR (index=zeek sourcetype=bro_conn id.resp_p=7844)
| eval sig=if(match(query,"argotunnel|trycloudflare"),"dns","port7844")
| stats count AS events, values(sig) AS signals, min(_time) AS first, max(_time) AS last
BY id.orig_h
| sort - events
# tune/validate: if you run Cloudflare Tunnel, list the approved connector
# hosts first and alert only on others.
- Query your DNS for the last 30 days of
trycloudflare.com; any hit from a server is an incident lead. - Review the Cloudflare accounts your organisation owns, so unknown tunnels can be separated from approved ones.
- Block outbound 7844 from segments that have no approved connector.
- Look for the agent binary dropped in temporary directories and run without installation.
Use the Cloudflare Tunnel documentation for connection requirements, SigmaHQ and Elastic coverage for cloudflared and tunneling tools, and your DNS and firewall telemetry. Always baseline your own environment — an enterprise that deploys Cloudflare Tunnel needs an allow-list of connector hosts before this signal is usable.
Build Detections That Fire
Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.
- Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
- Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
- 24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts