Cloudflared Tunnel Execution

Ethan Anderson@ethan

•updated Jul 17, 2025•4•2•72

Detects the execution of a Cloudflared that uses 'tunnel run' with a long token, which is indicative of a tunneling tool being used. This pattern is often associated with legitimate remote access tools or potentially malicious C2 frameworks.