Suspicious Process Initiated Network Connection To Ngrok Domain (via network_connection)

This rule detects an executable initiating a network connection to "ngrok" domains. Attackers were seen using this "ngrok" to store their second stage payloads and malware. While communication with such domains can be legitimate, frequently times is a sign of either data exfiltration by hostile actors or additional download.