How do you detect tunneling and proxying?

Detect tunneling by layering network, host and DNS signals: match the Chisel server's 'SSH-chisel-v3-server' handshake banner, alert on cloudflared traffic to Cloudflare's edge on port 7844 and *.trycloudflare.com DNS, flag ngrok tunnel-broker domains, and detect SOCKS pivots where internal hosts become reachable via one endpoint. On the host, alert on tunneler execution and use YARA to catch renamed single-binary tools. Detect fast flux via low-TTL domains resolving to many IPs across diverse ASNs. Emerging Threats and Zeek provide vetted detections.

Detecting Tunneling and Proxying: Chisel, ngrok, Cloudflared and Fast Flux

Attackers pivot and exfiltrate through tunnels and proxies — Chisel, Cloudflare Tunnel, ngrok and SOCKS — and keep infrastructure alive with fast flux. This pack covers the handshake banners, default ports and DNS patterns that reveal them. Layer signals, because any one is evadable.

Signals at a Glance

Tool	Signal	ATT&CK
Chisel	HTTP 101 upgrade with `SSH-chisel-v3-server` banner; `client`/`server` args	T1572
Cloudflare Tunnel	cloudflared to edge on UDP/TCP 7844; `*.trycloudflare.com`	T1572 T1090.002
ngrok	Connections to `*.ngrok.io`/tunnel brokers; local agent port 4040	T1090
SOCKS pivot	Internal hosts reachable via a SOCKS proxy from one endpoint	T1090.001
Fast flux	Low-TTL domain resolving to many IPs across diverse ASNs	T1568.001

Network Signatures

Several tunnelers reveal themselves in the handshake. Suricata-style matching on the Chisel server banner, and alerting on cloudflared’s fixed edge port, are high-fidelity starting points:

# Suricata-style logic (described)
# Chisel server handshake - HTTP 101 response body contains:
#     SSH-chisel-v3-server
# Cloudflare Tunnel - outbound to Cloudflare edge on port 7844 (UDP QUIC, TCP fallback)
#     and DNS for *.trycloudflare.com from non-approved hosts
# ngrok - DNS/SNI for *.ngrok.io, *.ngrok-free.app; local dashboard on 127.0.0.1:4040

Host & DNS

On the host, alert on chisel/cloudflared/ngrok execution (and on renamed single-binary tools — use YARA matching embedded module paths like github.com/jpillora/chisel to catch renames).
Restrict and monitor outbound 7844; hunt DNS/proxy logs for trycloudflare.com and tunnel-broker domains from hosts that should not tunnel.
Detect fast flux by flagging domains with abnormally low TTLs resolving to many IPs across diverse ASNs in a short window (double flux also rotates NS records).

Vetted sources

Emerging Threats/Suricata ship the Chisel banner and tunnel-broker signatures; Elastic and SigmaHQ cover cloudflared/ngrok execution; Corelight/Zeek detect fast flux and tunneling behaviourally.

Detect Tunnels and Pivots

Mjolnir Security helps organisations detect tunneling tools and takedown-resistant infrastructure.

Detection EngineeringNetwork DetectionManaged Detection & ResponseThreat HuntingIncident Response

Detection Engineering Building tunnel-handshake and egress detections.
Threat Hunting as a Service Hunting for Chisel, cloudflared and fast-flux activity.
24/7 Incident Response Containment when tunneling is detected. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026