Windows Process Command Lines Indicating ngrok.exe Tunnel Setup

title: Windows Process Command Lines Indicating ngrok.exe Tunnel Setup
id: d0f04e9d-da7f-4cc7-8096-87cd836406e4
status: test
description: This rule flags Windows process executions that match common ngrok command-line patterns used to start all tunnels via a YAML configuration. It also looks for ngrok.exe launches that include TCP/HTTP forwarding arguments and an authtoken parameter. These behaviors matter because tunneling tools can expose local services to the internet, which attackers frequently use for remote access and command-and-control. The detection relies on process creation telemetry, specifically the process image name and the full command line content.
references:
  - https://ngrok.com/docs
  - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
  - https://stackoverflow.com/questions/42442320/ssh-tunnel-to-ngrok-and-initiate-rdp
  - https://www.virustotal.com/gui/file/58d21840d915aaf4040ceb89522396124c82f325282f805d1085527e1e2ccfa1/detection
  - https://cybleinc.com/2021/02/15/ngrok-platform-abused-by-hackers-to-deliver-a-new-wave-of-phishing-attacks/
  - https://twitter.com/xorJosh/status/1598646907802451969
  - https://www.softwaretestinghelp.com/how-to-use-ngrok/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_ngrok.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-05-14
modified: 2023-02-21
tags:
  - attack.command-and-control
  - attack.t1572
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains:
      - " tcp 139"
      - " tcp 445"
      - " tcp 3389"
      - " tcp 5985"
      - " tcp 5986"
  selection2:
    CommandLine|contains|all:
      - " start "
      - --all
      - --config
      - .yml
  selection3:
    Image|endswith: ngrok.exe
    CommandLine|contains:
      - " tcp "
      - " http "
      - " authtoken "
  selection4:
    CommandLine|contains:
      - ".exe authtoken "
      - .exe start --all
  condition: 1 of selection*
falsepositives:
  - Another tool that uses the command line switches of Ngrok
  - Ngrok http 3978 (https://learn.microsoft.com/en-us/azure/bot-service/bot-service-debug-channel-ngrok?view=azure-bot-service-4.0)
level: high
license: DRL-1.1
related:
  - id: ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31
    type: derived