Linux process network connections to ngrok tunnel endpoints

Alerts on Linux connections to ngrok tunnel domains, which may indicate tunneling-based C2 or exfiltration.

FreeUnreviewedSigmahighv1

linux-process-network-connections-to-ngrok-tunnel-endpoints-19bf6fdb

title: Linux process network connections to ngrok tunnel endpoints
id: 3a8cf121-ec58-47c2-af2b-fb9086feaa57
status: test
description: This rule flags network connections where the destination hostname contains known ngrok tunnel service domains. Attackers can use tunneling services to relay traffic for command-and-control or to exfiltrate data through an external endpoint. It relies on Linux network connection telemetry with the destination hostname observed in each connection event.
references:
  - https://twitter.com/hakluke/status/1587733971814977537/photo/1
  - https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_ngrok_tunnel.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-11-03
tags:
  - attack.exfiltration
  - attack.command-and-control
  - attack.t1567
  - attack.t1568.002
  - attack.t1572
  - attack.t1090
  - attack.t1102
  - attack.s0508
logsource:
  product: linux
  category: network_connection
detection:
  selection:
    DestinationHostname|contains:
      - tunnel.us.ngrok.com
      - tunnel.eu.ngrok.com
      - tunnel.ap.ngrok.com
      - tunnel.au.ngrok.com
      - tunnel.sa.ngrok.com
      - tunnel.jp.ngrok.com
      - tunnel.in.ngrok.com
  condition: selection
falsepositives:
  - Legitimate use of ngrok
level: high
license: DRL-1.1
related:
  - id: 19bf6fdb-7721-4f3d-867f-53467f6a5db6
    type: derived

What it detects

This rule flags network connections where the destination hostname contains known ngrok tunnel service domains. Attackers can use tunneling services to relay traffic for command-and-control or to exfiltrate data through an external endpoint. It relies on Linux network connection telemetry with the destination hostname observed in each connection event.

Known false positives

Legitimate use of ngrok

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.