Cloudflared Tunnels Related DNS Requests — Detection Rule

Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read the full analysis on IntelFusions