Know Your Adversary

Hello everyone! Let's keep talking about modern ransomware affiliate's toolkit. Today we'll look at defense evasion and command and control capabilities. I came across this CISA advisory on Medusa Ransomware, and spotted the following tool - Cloudflared. It's used to securely expose applications, services, or servers to the internet via Cloudflare Tunnel without exposing them directly. Of course, adversaries abuse this feature! To create a tunnel, the threat actor should run the following command (or just run the installer, it creates a service and runs the command): cloudflared.exe tunnel run --token [redacted] Not very common command line arguments, right? Let's use it to build detection: event_type: "processcreate"  AND  cmdline: ("tunnel" AND "run" AND "token") Have you observed any other interesting tunneling tools ITW recently? See you tomorrow!