DIGGING TUNNELS: HUNTING ADVERSARIAL CLOUDFLARED INSTANCES

Summary from the TLDR InfoSec newsletter

Cloudflared is a popular tunneling service offered by Cloudflare that legitimate organizations or adversaries can utilize to establish persistence. Cloudflared authenticates using tokens that contain the account ID, tunnel ID, and a secret. Ransomware groups often do not vary their Cloudflare accounts, so detecting anomalous tokens or renamed processes can be effective for threat hunting.