Detect it by alerting on cloudflared execution, unexpected service installation, and outbound connections that establish a tunnel from the endpoint. Correlate with DNS, proxy, and process lineage to identify unauthorised remote access paths. If the tool is not approved for that host, treat installation or execution as a policy violation and investigate the user and parent process.
What makes Cloudflare Tunnel use visible on an endpoint?
Cloudflared is easiest to spot when you treat it as an endpoint-originated remote access path, not just another executable. The strongest signals are process execution, service creation, and sustained outbound traffic that matches tunnel establishment behaviour. On managed hosts, the key question is whether the binary, its parent process, and its network pattern fit an approved admin workflow or an unauthorised persistence or access attempt.
Because tunnel software blends into legitimate outbound traffic, endpoint telemetry matters more than perimeter inspection. Process creation, service control events, command-line arguments, and child process lineage help you distinguish a sanctioned remote support tool from a covert access channel. If execution happens from user-writable locations, staging folders, or unusual parent processes, that is usually more useful than looking only for a known filename.
Detection also improves when endpoint data is correlated with network and name-resolution evidence. A tunnel often produces a stable outbound session, recurring destination activity, and DNS patterns that do not resemble normal application traffic. When a cloudflared process appears alongside proxy bypass behaviour, repeated reconnects, or new service registration, the endpoint should be treated as the source of the access path until proven otherwise.
How should you confirm it is unauthorised?
The practical test is approval, context, and provenance. If cloudflared is not sanctioned for that device group, the event is not just suspicious use, it is a policy violation that may indicate unauthorised remote administration or exposure of internal services. You should validate which user launched it, which process spawned it, whether a service was installed, and whether the session aligns with a known support or engineering change.
The parent process matters because it often reveals intent. A browser, script host, archive tool, or office process spawning cloudflared is different from a managed software deployment mechanism or an approved admin console. If the endpoint also shows new autorun entries, scheduled tasks, or service changes, investigate it as a persistence or access-abuse event rather than a simple software installation.
For remote access abuse patterns, the surrounding activity is as important as the binary itself. If you see outbound tunnel establishment followed by remote commands, unusual port reachability, or access to internal applications that the endpoint should not mediate, you may be looking at an unauthorised bridge into the corporate environment. In that case, the endpoint is not just compromised, it may be acting as a proxy for external access.
What should your investigation and response focus on first?
Start with containment and scope. Determine whether the tunnel is still active, whether it was started interactively or by a service, and whether it is providing access to internal resources that should not be reachable from that host. If the host is unmanaged or the activity is outside policy, isolate the endpoint long enough to preserve process, service, and network evidence.
Then reconstruct the execution chain. Review command history, parent and child processes, downloaded artefacts, and any persistence created to relaunch the tunnel. If the same user or host has a pattern of remote-access tooling, investigate whether credentials, tokens, or support workflows were misused to justify the installation. A tunnel is often only the visible layer of a broader access decision.
Use detection content that already maps to command-and-control behaviour and tunnel abuse. NHIMG’s Command and Control (C2) Guide is directly useful here because cloudflared abuse often looks like a benign outbound control channel until you correlate process and egress evidence.
Risk and Threat Considerations
Unauthorised tunnel use matters because it can turn a single endpoint into an externally reachable access broker. That creates stealth, bypasses normal perimeter controls, and can conceal follow-on administration, data access, or lateral movement behind an apparently legitimate cloud service connection.
Failure mechanism: An attacker or insider runs cloudflared, persists it as a service or scheduled task, and uses the tunnel to reach internal systems without opening an obvious inbound port.
Impact: The organisation may lose visibility into how access is being brokered, while the endpoint becomes a hidden bridge for remote command, internal application access, or data exfiltration.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1071 — Application Layer Protocol | Cloudflared tunnel traffic commonly blends into normal outbound application traffic. |
| T1090 — Proxy | A Cloudflare Tunnel can act as a proxy-like relay for hidden access into internal systems. | |
| T1219 — Remote Access Software | cloudflared can be used as an unauthorised remote access path from endpoints. | |
| Recommendation — Correlate tunnel traffic with endpoint lineage and alert on protocol abuse patterns. Hunt for proxy-like relay behaviour and restrict unauthorized tunneling tools. Classify and detect unapproved remote access tooling on managed endpoints. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Endpoint process, service, and network telemetry are needed to detect tunnel abuse. |
| CM-7 — Least Functionality | Blocking unapproved tunneling tools reduces exposure from endpoint-borne access paths. | |
| AC-4 — Information Flow Enforcement | Tunnel software can bypass normal network control expectations by relaying internal access. | |
| Recommendation — Monitor endpoint executions, service installs, and outbound tunnel activity for anomalies. Restrict endpoints to approved software and remove unnecessary tunneling utilities. Enforce approved information flows and block unauthorized endpoint-to-internal relays. | ||
| OWASP API Security Top 10 | API7 — Server Side Request Forgery | Tunnel-based pivoting can expose internal services to unintended external reachability. |
| Recommendation — Review exposed internal services for unintended reachability through relay mechanisms. | ||
Practitioner Guidance
What to verify: Confirm whether cloudflared is approved for that endpoint class, who authorised it, and whether the observed parent process matches the approved deployment path. If the software was installed outside your standard software distribution or remote-support process, treat that as the first priority, not the destination service it reaches.
Common mistake: Teams often alert on the executable name but fail to preserve the execution chain and network context. That makes it harder to prove whether the tunnel was an approved admin tool, a persistence mechanism, or a short-lived access path used during compromise.
Decision rule: If the tunnel can reach internal services from a device that should not host that capability, prioritise isolation, evidence capture, and credential review before trying to “clean up” the installation. If the endpoint belongs to an approved remote-access program, validate change records and runtime identity before closing the case.
Practitioner takeaway: The detection goal is not simply to find cloudflared, but to prove whether the endpoint is being used as an authorised access broker or as an unauthorised tunnel into the corporate network.
Related resources from NHI Mgmt Group
- How do you detect unauthorised remote access tools like AnyDesk on Windows endpoints?
- How should security teams detect API abuse when attackers use valid credentials and legitimate endpoints?
- How should security teams use integrity controls to detect unauthorised change before it becomes a breach?
- How do you detect a session replay attack on a corporate web banking portal?