Linux network connections to ngrok tunneling endpoints
Alerts on Linux connections to ngrok tunnel domains, which may indicate tunneling-based C2 or exfiltration.
- Product
- linux
- Category
- network_connection
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-11-03
- Updated
- 2026-07-31
ATT&CK techniques
C2 → ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies executable network connections whose destination hostname contains ngrok tunnel domains across multiple regions. Such communications can indicate attempts to route traffic through an external tunneling service, which may be used to enable data exfiltration or command-and-control infrastructure. It relies on Linux network connection telemetry that includes destination hostname for outgoing connections.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux network connections to ngrok tunneling endpoints
id: 3a8cf121-ec58-47c2-af2b-fb9086feaa57
status: test
description: This rule identifies executable network connections whose destination hostname contains ngrok tunnel domains across multiple regions. Such communications can indicate attempts to route traffic through an external tunneling service, which may be used to enable data exfiltration or command-and-control infrastructure. It relies on Linux network connection telemetry that includes destination hostname for outgoing connections.
references:
- https://twitter.com/hakluke/status/1587733971814977537/photo/1
- https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_ngrok_tunnel.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-11-03
tags:
- attack.exfiltration
- attack.command-and-control
- attack.t1567
- attack.t1568.002
- attack.t1572
- attack.t1090
- attack.t1102
- attack.s0508
logsource:
product: linux
category: network_connection
detection:
selection:
DestinationHostname|contains:
- tunnel.us.ngrok.com
- tunnel.eu.ngrok.com
- tunnel.ap.ngrok.com
- tunnel.au.ngrok.com
- tunnel.sa.ngrok.com
- tunnel.jp.ngrok.com
- tunnel.in.ngrok.com
condition: selection
falsepositives:
- Legitimate use of ngrok
level: high
license: DRL-1.1
related:
- id: 19bf6fdb-7721-4f3d-867f-53467f6a5db6
type: derived