LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

devtunnel.exe

View source

Binary to enable forwarded ports on windows operating systems.

Download
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
03DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Download1

EXAMPLE 01T1105

Enabling a forwarded port for locally hosted service at port 8080 to be exposed on the internet.

COMMAND
devtunnel.exe host -p 8080
USE CASE
Download Files, Upload Files, Data Exfiltration
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11, MacOS
02 / ON DISK

Known paths

C:\Users\<username>\AppData\Local\Temp\.net\devtunnel\devtunnel.exe
C:\Users\<username>\AppData\Local\Temp\DevTunnels\devtunnel.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources

Indicators & detection notes

  • IOC

    devtunnel.exe binary spawned

  • IOC

    *.devtunnels.ms

  • IOC

    *.*.devtunnels.ms

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Kamran Saifullah@deFr0ggy