Windows Process Initiated Connections to Ngrok Domains
Alerts when a Windows process initiates an outbound connection to ngrok domain hostnames, which may indicate staging or C2 activity.
- Product
- windows
- Category
- network_connection
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-16
- Updated
- 2026-07-31
ATT&CK techniques
C2 → ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows processes that initiate network connections to hostnames ending with common ngrok domain patterns (.ngrok-free.app, .ngrok-free.dev, .ngrok.app, .ngrok.dev, .ngrok.io). Such tunneling services can be abused to support command-and-control or to deliver additional payloads, so these connections are security-relevant even though ngrok can be used legitimately. The detection relies on network_connection telemetry that includes the process initiator and the destination hostname.
Reporting behind it
- ngrok.comhttps://ngrok.com/
- ngrok.comhttps://ngrok.com/blog-post/new-ngrok-domains
- virustotal.comhttps://www.virustotal.com/gui/file/cca0c1182ac114b44dc52dd2058fcd38611c20bb6b5ad84710681d38212f835a/
- rnbo.gov.uahttps://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_ngrok.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Initiated Connections to Ngrok Domains
id: 956afcc8-1124-4e5a-ba8b-2f2be6af3441
related:
- id: 1d08ac94-400d-4469-a82f-daee9a908849
type: similar
- id: 18249279-932f-45e2-b37a-8925f2597670
type: derived
status: test
description: This rule flags Windows processes that initiate network connections to hostnames ending with common ngrok domain patterns (.ngrok-free.app, .ngrok-free.dev, .ngrok.app, .ngrok.dev, .ngrok.io). Such tunneling services can be abused to support command-and-control or to deliver additional payloads, so these connections are security-relevant even though ngrok can be used legitimately. The detection relies on network_connection telemetry that includes the process initiator and the destination hostname.
references:
- https://ngrok.com/
- https://ngrok.com/blog-post/new-ngrok-domains
- https://www.virustotal.com/gui/file/cca0c1182ac114b44dc52dd2058fcd38611c20bb6b5ad84710681d38212f835a/
- https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_ngrok.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-07-16
modified: 2025-07-30
tags:
- attack.exfiltration
- attack.command-and-control
- attack.t1567
- attack.t1572
- attack.t1102
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: "true"
DestinationHostname|endswith:
- .ngrok-free.app
- .ngrok-free.dev
- .ngrok.app
- .ngrok.dev
- .ngrok.io
condition: selection
falsepositives:
- Legitimate use of the ngrok service.
level: high
license: DRL-1.1