Windows: Detect ngrok Traffic Forwarded to Local RDP Port via TerminalServices Logs
Detects suspicious ngrok usage that forwards to the local RDP port using Windows TerminalServices-LocalSessionManager EventID 21.
- Product
- windows
- Service
- terminalservices-localsessionmanager
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-04-29
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows TerminalServices local session manager events where ngrok traffic is associated with the local RDP port indicator. Attackers may use reverse proxies like ngrok to expose or relay remote desktop access while bypassing normal access paths. Detection relies on terminal services event telemetry, matching a specific event identifier and an address field content associated with RDP forwarding.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect ngrok Traffic Forwarded to Local RDP Port via TerminalServices Logs"
id: 2c22abea-e2d4-454c-9112-fc27778e9ae9
status: test
description: This rule flags Windows TerminalServices local session manager events where ngrok traffic is associated with the local RDP port indicator. Attackers may use reverse proxies like ngrok to expose or relay remote desktop access while bypassing normal access paths. Detection relies on terminal services event telemetry, matching a specific event identifier and an address field content associated with RDP forwarding.
references:
- https://twitter.com/tekdefense/status/1519711183162556416?s=12&t=OTsHCBkQOTNs1k3USz65Zg
- https://ngrok.com/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/terminalservices/win_terminalservices_rdp_ngrok.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-29
tags:
- attack.command-and-control
- attack.t1090
logsource:
product: windows
service: terminalservices-localsessionmanager
detection:
selection:
EventID: 21
Address|contains: "16777216"
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 64d51a51-32a6-49f0-9f3d-17e34d640272
type: derived