huntrule

Windows Executable Initiating Connections to ngrok Tunnel Domains

Flags Windows network connections to ngrok tunnel subdomains that may indicate tunneling for C2 or staging.

FreeReviewedSigma · High · v2
Product
windows
Category
network_connection
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-11-03
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

C2 → Exfiltration

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows processes that establish network connections to hostnames containing common ngrok tunnel subdomains (for multiple regions). Such connectivity can indicate use of a tunneling service to support attacker infrastructure, including staging or follow-on payload delivery. It relies on network connection telemetry with destination hostname matching the specified ngrok tunnel patterns.

Reporting behind it

Related detections9 linkedT1572 — drag to rearrange
Linux network connections to ngrok tunneling endpoints
Windows Network Connections to LocaltoNet/Localtonet Tunneling Subdomains
Linux: Network connections initiated to LocaltoNet tunneling subdomains
Windows: Detect cloudflared tunnel cleanup command execution
Windows Process Creation: cloudflared Tunnel Execution with Config and Credentials Flags
Windows Process Initiated Connections to Ngrok Domains
Malicious Anubis Ransomware Cloudflare Tunnel via cloudflared (via process_creation)
Malicious QEMU Covert Network Tunnel via User-Mode netdev Socket (via process_creation)
Malicious Tunneling Tool Execution on Linux Host (via process_creation)
Windows Executable Initiating Connections to ngrok Tunnel Domains
Pivot detection · T1572 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.