Outbound Tunnel Service Installed On Managed Endpoint (Cloudflared Or Equivalent) - STRICT
SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown
Detects installation of an outbound tunnel service (Cloudflared or an equivalent tool such as ngrok, frp, chisel, or an SSH reverse tunnel), consistent with post-exploitation persistence observed after N-able N-central authentication bypass CVE-2026-18556/CVE-2026-18577. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Detecte l'installation d'un service de tunnel sortant (Cloudflared ou un outil equivalent comme ngrok, frp, chisel, ou un tunnel inverse SSH), coherente avec la persistance observee apres exploitation du contournement d'authentification N-able N-central CVE-2026-18556/CVE-2026-18577. Les intrusions documentees enregistrent un tunnel Cloudflare comme service Windows pour maintenir un canal sortant qui survit au redemarrage, depuis un endpoint atteint via la fonctionnalite Take Control apres prise de controle du serveur N-central. CORRECTION (red team interne) : la version initiale de cette regle ne couvrait que le binaire cloudflared.exe par son nom. Un attaquant conscient de cette detection precise n'a qu'a utiliser un outil de tunnel different (ngrok, frp, chisel, tunnel inverse SSH/plink) pour obtenir le meme objectif de persistance sans jamais toucher aux selections existantes. Des branches couvrant ces outils equivalents ont ete ajoutees. La presence de l'un de ces binaires ou services n'est pas malveillante en soi si l'organisation l'utilise deliberement pour un acces zero trust ou une administration a distance : voir falsepositives. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
title: Outbound Tunnel Service Installed On Managed Endpoint (Cloudflared Or Equivalent) - STRICT
id: a19956cd-7a07-44df-9382-bff1607eb6a8
status: experimental
description: |
Detects installation of an outbound tunnel service (Cloudflared or an equivalent tool such as ngrok, frp, chisel, or an SSH reverse tunnel), consistent with post-exploitation persistence observed after N-able N-central authentication bypass CVE-2026-18556/CVE-2026-18577. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Detecte l'installation d'un service de tunnel sortant (Cloudflared ou un outil equivalent comme ngrok, frp, chisel, ou un tunnel inverse SSH), coherente avec la persistance observee apres exploitation du contournement d'authentification N-able N-central CVE-2026-18556/CVE-2026-18577. Les intrusions documentees enregistrent un tunnel Cloudflare comme service Windows pour maintenir un canal sortant qui survit au redemarrage, depuis un endpoint atteint via la fonctionnalite Take Control apres prise de controle du serveur N-central. CORRECTION (red team interne) : la version initiale de cette regle ne couvrait que le binaire cloudflared.exe par son nom. Un attaquant conscient de cette detection precise n'a qu'a utiliser un outil de tunnel different (ngrok, frp, chisel, tunnel inverse SSH/plink) pour obtenir le meme objectif de persistance sans jamais toucher aux selections existantes. Des branches couvrant ces outils equivalents ont ete ajoutees. La presence de l'un de ces binaires ou services n'est pas malveillante en soi si l'organisation l'utilise deliberement pour un acces zero trust ou une administration a distance : voir falsepositives. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
references:
- https://arcticwolf.com/resources/blog/cve-2026-18556-cve-2026-18577/
- https://www.huntress.com/blog/n-able-vulnerability-exploitation
- https://www.n-able.com/blog/n-central-security-update-august-2-2026
- https://www.helpnetsecurity.com/2026/08/03/cve-2026-18577-n-able-n-central-vulnerability/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-18577
- https://nvd.nist.gov/vuln/detail/CVE-2026-18577
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-08-05
related:
- id: a382e092-ef96-40dd-ad4b-8511b48288c1
type: derived
logsource:
category: process_creation
product: windows
detection:
selection_cloudflared_service_install:
Image|endswith: '\cloudflared.exe'
CommandLine|contains:
- 'service install'
- 'tunnel run'
- 'tunnel --config'
- 'tunnel create'
- '--token'
selection_cloudflared_renamed_binary:
OriginalFileName: 'cloudflared.exe'
CommandLine|contains:
- 'service install'
- 'tunnel run'
- 'tunnel --config'
- 'tunnel create'
- '--token'
selection_sc_create_tunnel_tool:
Image|endswith:
- '\sc.exe'
- '\sc'
CommandLine|contains: 'create'
selection_sc_create_tunnel_tool_name:
CommandLine|contains:
- 'Cloudflared'
- 'cloudflared'
- 'frpc'
- 'chisel'
selection_alternate_tunnel_binary:
Image|endswith:
- '\ngrok.exe'
- '\frpc.exe'
- '\frp.exe'
- '\chisel.exe'
selection_alternate_tunnel_original_filename:
OriginalFileName:
- 'ngrok.exe'
- 'frpc.exe'
- 'chisel.exe'
selection_ssh_reverse_tunnel:
Image|endswith:
- '\ssh.exe'
- '\plink.exe'
CommandLine|contains: ' -R '
filter_main_known_zero_trust_deployment_tool:
ParentImage|endswith:
- '\ccmexec.exe'
- '\intune.exe'
- '\ansible.exe'
condition: >
(
selection_cloudflared_service_install
or selection_cloudflared_renamed_binary
or (selection_sc_create_tunnel_tool and selection_sc_create_tunnel_tool_name)
or selection_alternate_tunnel_binary
or selection_alternate_tunnel_original_filename
or selection_ssh_reverse_tunnel
)
and not 1 of filter_main_*
fields:
- UtcTime
- Computer
- User
- Image
- CommandLine
- ParentImage
- ParentCommandLine
- ProcessId
- ParentProcessId
- OriginalFileName
falsepositives:
- Organizations that intentionally deploy Cloudflare Tunnel, ngrok, or frp for legitimate zero trust remote access, expected to be rare and traceable to an approved software deployment tool
- Authorized IT staff installing a tunnel tool through a sanctioned RMM or configuration management pipeline
- Developers or operators using an SSH reverse tunnel (`ssh -R`) for legitimate remote debugging or port forwarding, expected to be traceable to a known engineering account and a documented change
level: high
tags:
- attack.persistence
- attack.command-and-control
- attack.t1136
- attack.t1543.003
- attack.t1572
- cve.2026-18556
- cve.2026-18577