huntrule

Windows: Detect ngrok Traffic Forwarded to Local RDP Port via TerminalServices Logs

Detects suspicious ngrok usage that forwards to the local RDP port using Windows TerminalServices-LocalSessionManager EventID 21.

FreeReviewedSigma · High · v2
Product
windows
Service
terminalservices-localsessionmanager
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-04-29
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows TerminalServices local session manager events where ngrok traffic is associated with the local RDP port indicator. Attackers may use reverse proxies like ngrok to expose or relay remote desktop access while bypassing normal access paths. Detection relies on terminal services event telemetry, matching a specific event identifier and an address field content associated with RDP forwarding.

Reporting behind it

Related detections9 linkedT1090 — drag to rearrange
Suspicious Flax Typhoon System Utility Masquerade Outside System32 via Renamed VPN Client (via process_creation)
Possible Credential Stuffing Blocked by Conditional Access in Microsoft 365
Possible ReverseSocks5 Tunneling Tool Execution on Linux (via process_creation)
Malicious GhostSocks Loader Execution with johnpidar Argument via process_creation
Malicious Chisel Reverse SOCKS Proxy Execution (via process_creation)
Malicious QEMU Covert Network Tunnel via User-Mode netdev Socket (via process_creation)
Malicious Tunneling Tool Execution on Linux Host (via process_creation)
Suspicious Chisel Reverse Tunnel Execution by UAT-9686
Suspicious macOS Trojan-Proxy LaunchAgent GoogleHelperUpdater Persistence (via file_event)
Windows: Detect ngrok Traffic Forwarded to Local RDP Port via TerminalServices Logs
Pivot detection · T1090 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.