Removed rule. This rule is known, but it is no longer present in its source. Showing the last known version.Removed: Jul 13, 2026, 4:10 PM
THL - Cloudflare Quick-Tunnel Bootstrap DNS Query from Server-Class Host (trycloudflare.com)
Sourcehunters-ledger
Filehunters-ledger.rules
CreatedApril 4, 2026
UpdatedJuly 6, 2026
Classificationpolicy-violation
alert dns $HOME_NET any -> any any (msg:"THL - Cloudflare Quick-Tunnel Bootstrap DNS Query from Server-Class Host (trycloudflare.com)"; dns.query; content:"trycloudflare.com"; nocase; endswith; classtype:policy-violation; sid:3500095; rev:1; metadata:author "The Hunters Ledger", campaign "OpenDirectory-RussianGeminiCredentialMill-213.165.51.115", mitre_tactic "command-and-control", mitre_technique "T1090.004 T1572 T1105", confidence MODERATE, created_at 2026-05-25, note "tune-to-server-segments-exclude-developer-workstations";)
Metadata
author"The Hunters Ledger"
campaign"OpenDirectory-RussianGeminiCredentialMill-213.165.51.115"
mitre tactic"command-and-control"
mitre technique"T1090.004 T1572 T1105"
confidenceMODERATE
created at2026-05-25
note"tune-to-server-segments-exclude-developer-workstations"
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!