Windows Executable Connects to ngrok Tunneling Domains

Flags Windows network connections to ngrok tunnel subdomains that may indicate tunneling for C2 or staging.

FreeUnreviewedSigmahighv1

windows-executable-connects-to-ngrok-tunneling-domains-1d08ac94

title: Windows Executable Connects to ngrok Tunneling Domains
id: d30ed6cc-82df-4a62-a287-b6dc58174a5b
related:
  - id: 18249279-932f-45e2-b37a-8925f2597670
    type: similar
  - id: 1d08ac94-400d-4469-a82f-daee9a908849
    type: derived
status: test
description: This rule identifies network connections from an executable to ngrok tunneling subdomains (tunnel.*.ngrok.com). Such connectivity can indicate attacker-controlled infrastructure used to pass data or stage follow-on payloads, even though ngrok can be used legitimately for development and secure tunneling. It relies on Windows network connection telemetry that includes the destination hostname.
references:
  - https://twitter.com/hakluke/status/1587733971814977537/photo/1
  - https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_ngrok_tunnel.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-11-03
modified: 2024-02-02
tags:
  - attack.exfiltration
  - attack.command-and-control
  - attack.t1567
  - attack.t1568.002
  - attack.t1572
  - attack.t1090
  - attack.t1102
  - attack.s0508
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - tunnel.us.ngrok.com
      - tunnel.eu.ngrok.com
      - tunnel.ap.ngrok.com
      - tunnel.au.ngrok.com
      - tunnel.sa.ngrok.com
      - tunnel.jp.ngrok.com
      - tunnel.in.ngrok.com
  condition: selection
falsepositives:
  - Legitimate use of the ngrok service.
level: high
license: DRL-1.1

What it detects

This rule identifies network connections from an executable to ngrok tunneling subdomains (tunnel.*.ngrok.com). Such connectivity can indicate attacker-controlled infrastructure used to pass data or stage follow-on payloads, even though ngrok can be used legitimately for development and secure tunneling. It relies on Windows network connection telemetry that includes the destination hostname.

Known false positives

Legitimate use of the ngrok service.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.