How do you detect a covert WireGuard tunnel?

Detect covert WireGuard by structure and by host artifacts. On the wire, match the fixed handshake: a 148-byte UDP initiation beginning with 01 00 00 00 answered by a 92-byte response, 32-byte keepalives and a persistent 25-second cadence, treating UDP 51820 as a hint because the port can change. On endpoints, alert on wg, wg-quick or wireguard.exe, a wg0 interface on hosts with no VPN role, wintun.dll loads and WireGuardTunnel service installs, and search for configs with an external Endpoint. Allow-list your sanctioned remote-access use first.

Detecting Covert WireGuard Tunnels: Handshakes, Interfaces and Services

WireGuard is a fast, modern VPN that an operator can set up in minutes to carry all traffic from a compromised host to infrastructure they control. It is legitimate, widely used and unauthenticated from the network’s point of view, so detection depends on spotting unsanctioned instances: by handshake shape on the wire, and by interface, driver and service artifacts on the endpoint.

Signals at a Glance

Signal	Where	ATT&CK
UDP flows to an external host with 148-byte initiation and 92-byte response packets	Suricata, Zeek packet data, NGFW	T1572
Outbound UDP 51820 (default listen port)	Firewall, Zeek conn.log	T1572
wg, wg-quick or wireguard.exe execution; a wg0 interface on a host with no VPN role	auditd, Sysmon, EDR	T1572
wintun.dll loaded or WireGuardTunnel service installed on a Windows endpoint	Sysmon 7, service event 7045	T1543.003
Persistent keepalive at 25-second intervals with small packets	Flow, NetFlow	T1572

Handshake and Port Signals

The WireGuard protocol begins with a handshake initiation of 148 bytes whose first four bytes are the message type 01 00 00 00, answered by a 92-byte response with type 2. Data packets are encrypted, but keepalives are a fixed 32-byte payload. Operators can change the listen port, so match the structure and treat 51820 as a hint:

# Suricata - WireGuard handshake initiation (local sid range; validate before use)
alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"HUNT WireGuard handshake initiation to external host"; dsize:148; content:"|01 00 00 00|"; depth:4; threshold:type limit, track by_src, count 1, seconds 3600; classtype:policy-violation; sid:9100002; rev:1;)
# tune/validate: allow-list approved remote-access gateways (by destination)
# and run in hunt mode first; random UDP can occasionally match 148 bytes.

Interface, Driver and Service Artifacts

On Linux the interface is typically created by wg-quick up from a config in /etc/wireguard/. On Windows, the official client installs the Wintun driver and runs each tunnel as a service named WireGuardTunnel$name. Both provide high-value host signals:

// Microsoft Defender XDR (KQL) - WireGuard on endpoints
union
(DeviceProcessEvents
  | where FileName in~ ("wg", "wg-quick", "wireguard.exe", "wg.exe")
       or ProcessCommandLine has_any ("wg-quick up", "/installtunnelservice")
  | project Timestamp, DeviceName, Signal="process", Detail=ProcessCommandLine),
(DeviceImageLoadEvents
  | where FileName =~ "wintun.dll"
  | project Timestamp, DeviceName, Signal="wintun", Detail=InitiatingProcessFileName),
(DeviceEvents
  | where ActionType == "ServiceInstalled" and AdditionalFields has "WireGuardTunnel"
  | project Timestamp, DeviceName, Signal="service", Detail=AdditionalFields)
| order by Timestamp desc
// tune/validate: join to your approved VPN client inventory and exclude it.

Search for .conf files containing an [Interface] block with PrivateKey and a [Peer] with an external Endpoint.
Block outbound UDP from servers to the Internet except for named destinations, and log denies.
Alert on servers that have no VPN role and suddenly hold a long-lived small-packet UDP flow with a 25-second cadence.
Remember that WireGuard on a mobile or home device is a policy matter, and that the same tool on a server is an incident lead.

Vetted sources

Use the WireGuard protocol whitepaper for message sizes, SigmaHQ and Elastic coverage for WireGuard and Wintun, Splunk ESCU service-install analytics, Suricata and NGFW app-ID for UDP VPN identification. Always baseline your own environment — sanctioned WireGuard use exists and must be listed before these detections are enforced.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Handshake and Port Signals

Interface, Driver and Service Artifacts

Build Detections That Fire

Protocol Tunneling Detection

Detection Hub

GRE and IP-in-IP Tunnel Detection

ngrok Abuse Detection