{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/reverse-proxy/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Cloudflared","Splunk Enterprise","Splunk Enterprise Security","Splunk Cloud"],"_cs_severities":["medium"],"_cs_tags":["cloudflared","reverse-proxy","tunneling","network-tunnel"],"_cs_type":"advisory","_cs_vendors":["Cloudflare","Splunk"],"content_html":"\u003cp\u003eCloudflared is a tool that creates secure tunnels through Cloudflare\u0026rsquo;s network, similar in function to ngrok. Attackers can abuse Cloudflared to establish stealthy connections to compromised systems, bypassing traditional network security controls. The tool creates an outbound connection over HTTPS (HTTP2/QUIC) to Cloudflare Edge Servers. The tunnel controller then makes services or private networks accessible, potentially enabling data exfiltration or remote access without direct exposure of the target system. This technique has been observed in the wild, where threat actors leverage Cloudflare tunnels to mask their activities. Detecting Cloudflared connections can be challenging due to the legitimate use of the tool, but monitoring network connections for specific patterns can help identify potentially malicious activity.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker gains initial access to a target system, potentially through phishing or exploitation of a vulnerability.\u003c/li\u003e\n\u003cli\u003eThe attacker downloads and installs the Cloudflared tool on the compromised system.\u003c/li\u003e\n\u003cli\u003eThe attacker configures Cloudflared to create a tunnel to a Cloudflare Edge Server, specifying a local service or port to forward.\u003c/li\u003e\n\u003cli\u003eCloudflared establishes an outbound connection to Cloudflare over HTTPS (HTTP2/QUIC) on port 7844.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the Cloudflare tunnel to access internal resources or exfiltrate data from the compromised system, bypassing traditional network security controls.\u003c/li\u003e\n\u003cli\u003eThe attacker maintains persistent access through the Cloudflare tunnel, enabling ongoing command and control.\u003c/li\u003e\n\u003cli\u003eThe attacker may use the tunnel to proxy connections to other internal systems, further expanding their reach within the network.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves their objective, such as data theft, ransomware deployment, or disruption of services.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation can lead to unauthorized access to internal resources, data exfiltration, and potential compromise of sensitive information. The use of Cloudflare tunnels makes it difficult to trace the attacker\u0026rsquo;s origin, hindering incident response efforts. Abuse of Cloudflared may lead to full system compromise, intellectual property theft, and reputational damage. While no specific victim counts or sector targeting is identified in this source, the increasing abuse of Cloudflare tunnels by hackers is noted by BleepingComputer.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the \u0026ldquo;Detect Potential Cloudflared Network Tunnel\u0026rdquo; Sigma rule to your SIEM and tune it for your environment, focusing on \u003ccode\u003eNetwork_Traffic.All_Traffic\u003c/code\u003e data model, dest_port 7844, and associated network connection details.\u003c/li\u003e\n\u003cli\u003eImplement Sysmon Event ID 3 (Network Connect) logging to provide the data necessary for the provided Sigma rule.\u003c/li\u003e\n\u003cli\u003eFilter alerts generated by the Sigma rule based on known and approved Cloudflared deployments within the organization to reduce false positives, as noted in the \u0026ldquo;known_false_positives\u0026rdquo; section.\u003c/li\u003e\n\u003cli\u003eReview network connection logs for outbound connections to Cloudflare Edge Servers on destination port 7844, as highlighted in the attack chain, to identify potential unauthorized Cloudflared usage.\u003c/li\u003e\n\u003cli\u003eInvestigate endpoints exhibiting suspicious network connection behavior involving Cloudflared, focusing on process ancestry and command-line arguments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"/briefs/2024-01-cloudflared-tunnel/","summary":"This brief detects network connection events associated with the Cloudflared tool, used to create tunnels via Cloudflare, potentially for unauthorized access or exfiltration, by establishing outbound connections to Cloudflare Edge Servers.","title":"Potential Cloudflared Network Tunnel Detection","url":"https://feed.craftedsignal.io/briefs/2024-01-cloudflared-tunnel/"},{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Cloudflared","Splunk Enterprise","Splunk Enterprise Security","Splunk Cloud"],"_cs_severities":["high"],"_cs_tags":["cloudflare","reverse-proxy","tunnel","command-and-control"],"_cs_type":"advisory","_cs_vendors":["Cloudflare","Splunk"],"content_html":"\u003cp\u003eCloudflared is a legitimate tool used to create secure tunnels through the Cloudflare network, providing access to services or private networks behind a firewall without opening inbound ports. Attackers are abusing cloudflared in a similar fashion to ngrok, to establish reverse tunnels, creating stealthy command and control (C2) channels. By leveraging Cloudflare\u0026rsquo;s infrastructure, attackers can effectively mask their malicious traffic, making it difficult to detect and block. This technique has been observed in the wild with increasing frequency, posing a significant challenge to traditional network security monitoring. Defenders should monitor for suspicious cloudflared command-line arguments and network activity.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker gains initial access to a compromised system, often through phishing or exploiting a vulnerability.\u003c/li\u003e\n\u003cli\u003eThe attacker downloads the cloudflared client onto the compromised system. This can be achieved through various methods, including PowerShell or command-line execution.\u003c/li\u003e\n\u003cli\u003eThe attacker executes the cloudflared client with specific command-line arguments to establish a tunnel. This includes specifying a run token, a URL pointing to a local service (localhost), or a pre-configured tunnel configuration.\u003c/li\u003e\n\u003cli\u003eCloudflared establishes an outbound connection to Cloudflare\u0026rsquo;s edge servers over HTTPS (HTTP2/QUIC), creating a tunnel controller.\u003c/li\u003e\n\u003cli\u003eThe attacker proxies traffic through the Cloudflare tunnel to a command and control (C2) server, masking the origin of the traffic.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the established tunnel for various malicious activities, such as data exfiltration, lateral movement, or deploying ransomware.\u003c/li\u003e\n\u003cli\u003eThe attacker maintains persistence by configuring cloudflared to run automatically on system startup or through scheduled tasks.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to establish persistent, stealthy command and control channels, bypassing traditional network security controls. This can lead to data exfiltration, ransomware deployment, and other malicious activities. The abuse of Cloudflare tunnels makes it difficult to trace the origin of the attack, hindering incident response efforts. Without proper detection, organizations may be unaware of the presence of malicious actors within their network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor process creation events (Sysmon EventID 1, Windows Event Log Security 4688) for command-line arguments associated with cloudflared execution, specifically looking for \u0026ldquo;tunnel\u0026rdquo;, \u0026ldquo;run\u0026rdquo;, \u0026ldquo;token\u0026rdquo;, \u0026ldquo;\u0026ndash;url\u0026rdquo;, and \u0026ldquo;localhost\u0026rdquo; (see the provided Splunk search query).\u003c/li\u003e\n\u003cli\u003eImplement the provided Sigma rules to detect suspicious cloudflared tunnel execution based on command-line arguments.\u003c/li\u003e\n\u003cli\u003eReview and filter alerts generated by the Sigma rules based on approved usage and trusted users to reduce false positives, as legitimate DevOps or IT teams may use Cloudflared.\u003c/li\u003e\n\u003cli\u003eInspect network connections for outbound traffic to Cloudflare\u0026rsquo;s infrastructure originating from unusual or unauthorized processes to identify potential tunnel abuse.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"/briefs/2024-01-03-cloudflared-tunnel-execution/","summary":"Attackers are increasingly abusing Cloudflare tunnels, created via the cloudflared client, for establishing stealthy command and control channels and evading network defenses by proxying traffic through Cloudflare's infrastructure.","title":"Potential Abuse of Cloudflare Tunnels via Cloudflared","url":"https://feed.craftedsignal.io/briefs/2024-01-03-cloudflared-tunnel-execution/"},{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Visual Studio","Splunk Enterprise","Splunk Enterprise Security","Splunk Cloud"],"_cs_severities":["high"],"_cs_tags":["devtunnels","reverse-proxy","command-and-control","defense-evasion","windows"],"_cs_type":"advisory","_cs_vendors":["Microsoft","Splunk"],"content_html":"\u003cp\u003eMicrosoft Devtunnels, a feature within Visual Studio, enables developers to expose local development environments to the internet via secure tunnels. While designed for legitimate testing and debugging, attackers can abuse this functionality to establish covert communication channels from compromised systems. By executing \u003ccode\u003edevtunnel.exe\u003c/code\u003e or loading \u003ccode\u003edevtunnel.dll\u003c/code\u003e, an attacker can bypass network security measures and blend malicious activity with legitimate development traffic. This allows for remote access, data exfiltration, or command-and-control communications, making detection more challenging. This technique could be used to expose internal services or systems without proper authentication to the outside world, potentially leading to further compromise.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial compromise of a system via typical methods (e.g., phishing, exploit).\u003c/li\u003e\n\u003cli\u003eAttacker gains a foothold and establishes persistence on the compromised system.\u003c/li\u003e\n\u003cli\u003eAttacker executes \u003ccode\u003edevtunnel.exe\u003c/code\u003e or loads \u003ccode\u003edevtunnel.dll\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe Dev Tunnels feature is configured to expose a service or the entire system to the internet.\u003c/li\u003e\n\u003cli\u003eA secure, temporary tunnel is established, bypassing normal network security measures.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the tunnel to remotely access the compromised system.\u003c/li\u003e\n\u003cli\u003eData exfiltration or command-and-control activities are performed through the tunnel.\u003c/li\u003e\n\u003cli\u003eThe attacker maintains persistent access and control over the compromised system, blending their activities with legitimate development traffic.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to create covert communication channels, bypass network security measures, and exfiltrate sensitive data. The use of Dev Tunnels can make it difficult to detect malicious activity, as it blends in with legitimate development traffic. This can lead to prolonged access to compromised systems and significant data breaches. Lateral movement may be easier if internal services are exposed through the tunnel. The number of victims and the extent of the damage depend on the specific targets and the attacker\u0026rsquo;s objectives.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement the Sigma rules provided in this brief to detect the execution of \u003ccode\u003edevtunnel.exe\u003c/code\u003e and the loading of \u003ccode\u003edevtunnel.dll\u003c/code\u003e within your environment.\u003c/li\u003e\n\u003cli\u003eMonitor process creation events (Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2) for the execution of \u003ccode\u003edevtunnel.exe\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eInvestigate any instances of \u003ccode\u003edevtunnel.exe\u003c/code\u003e execution, especially those originating from unusual locations or user accounts.\u003c/li\u003e\n\u003cli\u003eFilter alerts (as mentioned in the known_false_positives) for approved development environments and users to reduce false positives.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon process-creation logging to ensure the effectiveness of the provided Sigma rules.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T10:00:00Z","date_published":"2024-01-03T10:00:00Z","id":"/briefs/2024-01-devtunnels-execution/","summary":"The execution of Microsoft devtunnels.exe can be abused by attackers to expose compromised systems to the internet, establish covert communication channels, and bypass network security measures, facilitating data exfiltration or command-and-control.","title":"Microsoft Devtunnels Execution for Covert Communication","url":"https://feed.craftedsignal.io/briefs/2024-01-devtunnels-execution/"},{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Visual Studio","Splunk Enterprise","Splunk Enterprise Security","Splunk Cloud"],"_cs_severities":["medium"],"_cs_tags":["devtunnels","reverse-proxy","command-and-control","data-exfiltration","windows"],"_cs_type":"advisory","_cs_vendors":["Microsoft","Splunk"],"content_html":"\u003cp\u003eMicrosoft Devtunnels, a feature within Visual Studio, allows developers to expose their local development environment to the internet through secure, temporary tunnels. While intended for legitimate purposes like testing webhooks and APIs, attackers can abuse this functionality. By exploiting Devtunnels, a malicious actor could expose a compromised system to the internet, establishing a covert communication channel that circumvents traditional network security measures. This unauthorized access enables data exfiltration, command-and-control (C2) communications, and further compromise of the environment while blending the malicious activity with legitimate development traffic. Defenders should monitor for anomalous image loads associated with Devtunnels to identify potential misuse.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker compromises a system within the target network.\u003c/li\u003e\n\u003cli\u003eAttacker installs or leverages an existing Visual Studio installation on the compromised system.\u003c/li\u003e\n\u003cli\u003eThe attacker configures Microsoft Devtunnels to expose the compromised system to the internet. This may involve creating a new tunnel or hijacking an existing one.\u003c/li\u003e\n\u003cli\u003eA malicious DLL (devtunnel.dll) is loaded from the temp directory (\u003ccode\u003e*\\\\AppData\\\\Local\\\\Temp\\\\.net\\\\devtunnel\\\\*\u003c/code\u003e) to establish the tunnel.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the established Devtunnel to create a reverse proxy to bypass network security measures.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the Devtunnel for command and control, sending commands and receiving responses from the compromised system.\u003c/li\u003e\n\u003cli\u003eThe attacker exfiltrates sensitive data from the compromised system through the Devtunnel.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of Microsoft Devtunnels can lead to significant security breaches. Attackers can establish persistent covert communication channels, exfiltrate sensitive data, and maintain long-term control over compromised systems. This can result in financial losses, reputational damage, and legal liabilities. The use of Devtunnels can bypass existing network security measures, making detection challenging and increasing the dwell time of attackers within the network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable Sysmon EventID 7 to monitor image load events, which is the data source for the provided detection rule.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Devtunnels Image Load\u003c/code\u003e to your SIEM and tune the filter \u003ccode\u003ewindows_devtunnels_image_loaded_filter\u003c/code\u003e for your environment to reduce false positives from legitimate developer activity.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for connections associated with Devtunnels to identify potential covert communication channels.\u003c/li\u003e\n\u003cli\u003eInvestigate any alerts triggered by the \u003ccode\u003eDetect Devtunnels Image Load\u003c/code\u003e rule, focusing on systems with development tools installed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-02T12:00:00Z","date_published":"2024-01-02T12:00:00Z","id":"/briefs/2024-01-02-devtunnels-image-load/","summary":"This detection identifies potential misuse of Microsoft Devtunnels within Visual Studio by detecting image load events, indicating that an attacker could expose a compromised system or service to the internet for covert communication and data exfiltration.","title":"Microsoft Devtunnels Image Load Detection","url":"https://feed.craftedsignal.io/briefs/2024-01-02-devtunnels-image-load/"}],"language":"en","title":"CraftedSignal Threat Feed — Reverse-Proxy","version":"https://jsonfeed.org/version/1.1"}