huntrule

Windows: ngrok Forwarding to Local RDP Port via TerminalServices EventID 21

Detects suspicious ngrok usage that forwards to the local RDP port using Windows TerminalServices-LocalSessionManager EventID 21.

FreeUnreviewedSigmahighv1
title: "Windows: ngrok Forwarding to Local RDP Port via TerminalServices EventID 21"
id: 2c22abea-e2d4-454c-9112-fc27778e9ae9
status: test
description: This rule flags Windows Terminal Services local session activity where an EventID 21 record contains an address value indicative of ngrok forwarding to the local RDP port. Reverse proxies like ngrok can be abused to expose or relay remote access channels, which may enable unauthorized connectivity or command-and-control through RDP. The detection relies on Windows TerminalServices-LocalSessionManager event telemetry, specifically EventID 21 and the presence of a matching address substring.
references:
  - https://twitter.com/tekdefense/status/1519711183162556416?s=12&t=OTsHCBkQOTNs1k3USz65Zg
  - https://ngrok.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/terminalservices/win_terminalservices_rdp_ngrok.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-29
tags:
  - attack.command-and-control
  - attack.t1090
logsource:
  product: windows
  service: terminalservices-localsessionmanager
detection:
  selection:
    EventID: 21
    Address|contains: "16777216"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 64d51a51-32a6-49f0-9f3d-17e34d640272
    type: derived

What it detects

This rule flags Windows Terminal Services local session activity where an EventID 21 record contains an address value indicative of ngrok forwarding to the local RDP port. Reverse proxies like ngrok can be abused to expose or relay remote access channels, which may enable unauthorized connectivity or command-and-control through RDP. The detection relies on Windows TerminalServices-LocalSessionManager event telemetry, specifically EventID 21 and the presence of a matching address substring.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.