Suspicious Traffic To Ngrok Tunneling Service Initiated (via network_connection)

This rule detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" to store their second stage payloads and malware. While communication with such domains can be legitimate, frequently times is a sign of either data exfiltration by hostile actors or additional download.