Cloudflared Windows Service Registration for Tunnel Persistence

Ethan Andrews@eandrews

•updated Aug 4, 2026•5•0•16

Detects signs of Cloudflared tunnel persistence on Windows endpoints, specifically targeting service registration (via sc.exe or registry modifications) and the presence of the cloudflared.exe binary. This is often used by attackers to maintain outbound-only access to compromised machines following exploitation of vulnerabilities like CVE-2026-18577.