Windows Process Command Lines Indicating ngrok.exe Tunnel Setup
Detects Windows executions of ngrok.exe with TCP/HTTP tunneling and authtoken/start-all YAML configuration patterns.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-05-14
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows process executions that match common ngrok command-line patterns used to start all tunnels via a YAML configuration. It also looks for ngrok.exe launches that include TCP/HTTP forwarding arguments and an authtoken parameter. These behaviors matter because tunneling tools can expose local services to the internet, which attackers frequently use for remote access and command-and-control. The detection relies on process creation telemetry, specifically the process image name and the full command line content.
Reporting behind it
- ngrok.comhttps://ngrok.com/docs
- fireeye.comhttps://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
- stackoverflow.comhttps://stackoverflow.com/questions/42442320/ssh-tunnel-to-ngrok-and-initiate-rdp
- virustotal.comhttps://www.virustotal.com/gui/file/58d21840d915aaf4040ceb89522396124c82f325282f805d1085527e1e2ccfa1/detection
- cybleinc.comhttps://cybleinc.com/2021/02/15/ngrok-platform-abused-by-hackers-to-deliver-a-new-wave-of-phishing-attacks/
- twitter.comhttps://twitter.com/xorJosh/status/1598646907802451969
- softwaretestinghelp.comhttps://www.softwaretestinghelp.com/how-to-use-ngrok/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_ngrok.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Command Lines Indicating ngrok.exe Tunnel Setup
id: d0f04e9d-da7f-4cc7-8096-87cd836406e4
status: test
description: This rule flags Windows process executions that match common ngrok command-line patterns used to start all tunnels via a YAML configuration. It also looks for ngrok.exe launches that include TCP/HTTP forwarding arguments and an authtoken parameter. These behaviors matter because tunneling tools can expose local services to the internet, which attackers frequently use for remote access and command-and-control. The detection relies on process creation telemetry, specifically the process image name and the full command line content.
references:
- https://ngrok.com/docs
- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
- https://stackoverflow.com/questions/42442320/ssh-tunnel-to-ngrok-and-initiate-rdp
- https://www.virustotal.com/gui/file/58d21840d915aaf4040ceb89522396124c82f325282f805d1085527e1e2ccfa1/detection
- https://cybleinc.com/2021/02/15/ngrok-platform-abused-by-hackers-to-deliver-a-new-wave-of-phishing-attacks/
- https://twitter.com/xorJosh/status/1598646907802451969
- https://www.softwaretestinghelp.com/how-to-use-ngrok/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_ngrok.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-05-14
modified: 2023-02-21
tags:
- attack.command-and-control
- attack.t1572
logsource:
category: process_creation
product: windows
detection:
selection1:
CommandLine|contains:
- " tcp 139"
- " tcp 445"
- " tcp 3389"
- " tcp 5985"
- " tcp 5986"
selection2:
CommandLine|contains|all:
- " start "
- --all
- --config
- .yml
selection3:
Image|endswith: ngrok.exe
CommandLine|contains:
- " tcp "
- " http "
- " authtoken "
selection4:
CommandLine|contains:
- ".exe authtoken "
- .exe start --all
condition: 1 of selection*
falsepositives:
- Another tool that uses the command line switches of Ngrok
- Ngrok http 3978 (https://learn.microsoft.com/en-us/azure/bot-service/bot-service-debug-channel-ngrok?view=azure-bot-service-4.0)
level: high
license: DRL-1.1
related:
- id: ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31
type: derived