DNS Query To Devtunnels Domain — Detection Rule

Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Read the full analysis on IntelFusions