Binary to enable forwarded ports on windows operating systems. Located at: C:\Users\<username>\AppData\Local\Temp\.net\devtunnel\devtunnel.exe; C:\Users\<username>\AppData\Local\Temp\DevTunnels\devtunnel.exe.
devtunneldevtunnelSandbox: execFile · Timeout: 30s
network.transfer.download Outputs
process.output Command execution output
network_traffic Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | medium |
| Disk I/O | low |
Enabling a forwarded port for locally hosted service at port 8080 to be exposed on the internet. (Download Files, Upload Files, Data Exfiltration)
devtunnel.exe host -p 8080| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/dns_query/dns_query_win_devtunnels_communication.yml |
| sigma | https://github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/network_connection/net_connection_win_domain_devtunnels.yml |
| ioc | devtunnel.exe binary spawned |
| ioc | *.devtunnels.ms |
| ioc | *.*.devtunnels.ms |
| other | https://cydefops.com/vscode-data-exfiltration |
devtunnel is a Windows LOLBin. Binary to enable forwarded ports on windows operating systems. Located at: C:\Users<username>\AppData\Local\Temp.net\devtunnel\devtunnel.exe; C:\Users<username>\AppData\Local\Temp\DevTunnels\devtunnel.exe.