rules/windows: add Dev Tunnel hosting or creation process_creation rule

[BL3IP]

Summary

Adds a process_creation detection for Microsoft Dev Tunnels (devtunnel.exe) being used to host or create a tunnel that exposes a local endpoint via *.devtunnels.ms. Adversaries abuse Dev Tunnels for C2, reverse shells and persistent remote access that blends in with trusted Microsoft domains (MITRE T1572).

Why

Dev Tunnels are currently detected via dns_query (DNS Query To Devtunnels Domain) and network_connection (Net Connection DevTunnels), but not at the process_creation layer - i.e. nothing catches the on-host CLI setting up the tunnel. This rule fills that gap and is cross-linked to the two existing rules via the related field.

Validation

• sigma check -> 0 errors, 0 issues
• python -m pytest tests/test_rules.py -> all pass
• Splunk/sysmon conversion: EventID=1 Image endswith devtunnel.exe + host/create/port forward

References

• https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2
• https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/cli-commands

[github-actions]

Welcome @BL3IP 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

If you want to engage more with the community for official support, general discussions or announcements:

👉 Join our Discord server