Windows Network Connections Initiated to ngrok Domains

Alerts when a Windows process initiates an outbound connection to ngrok domain hostnames, which may indicate staging or C2 activity.

FreeUnreviewedSigmahighv1

windows-network-connections-initiated-to-ngrok-domains-18249279

title: Windows Network Connections Initiated to ngrok Domains
id: 956afcc8-1124-4e5a-ba8b-2f2be6af3441
related:
  - id: 1d08ac94-400d-4469-a82f-daee9a908849
    type: similar
  - id: 18249279-932f-45e2-b37a-8925f2597670
    type: derived
status: test
description: This rule flags Windows processes that initiate network connections to hostnames ending with common ngrok domains (e.g., ngrok.io, ngrok.app, and ngrok-free variants). Attackers may use ngrok to host or relay payloads and support command-and-control, making these outbound connections a valuable indicator of suspicious activity. It relies on network connection telemetry that includes the initiating process and the destination hostname.
references:
  - https://ngrok.com/
  - https://ngrok.com/blog-post/new-ngrok-domains
  - https://www.virustotal.com/gui/file/cca0c1182ac114b44dc52dd2058fcd38611c20bb6b5ad84710681d38212f835a/
  - https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_ngrok.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-07-16
modified: 2025-07-30
tags:
  - attack.exfiltration
  - attack.command-and-control
  - attack.t1567
  - attack.t1572
  - attack.t1102
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith:
      - .ngrok-free.app
      - .ngrok-free.dev
      - .ngrok.app
      - .ngrok.dev
      - .ngrok.io
  condition: selection
falsepositives:
  - Legitimate use of the ngrok service.
level: high
license: DRL-1.1

What it detects

This rule flags Windows processes that initiate network connections to hostnames ending with common ngrok domains (e.g., ngrok.io, ngrok.app, and ngrok-free variants). Attackers may use ngrok to host or relay payloads and support command-and-control, making these outbound connections a valuable indicator of suspicious activity. It relies on network connection telemetry that includes the initiating process and the destination hostname.

Known false positives

Legitimate use of the ngrok service.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.