huntrule

Windows Process Command Lines Indicating ngrok.exe Tunnel Setup

Detects Windows executions of ngrok.exe with TCP/HTTP tunneling and authtoken/start-all YAML configuration patterns.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-05-14
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process executions that match common ngrok command-line patterns used to start all tunnels via a YAML configuration. It also looks for ngrok.exe launches that include TCP/HTTP forwarding arguments and an authtoken parameter. These behaviors matter because tunneling tools can expose local services to the internet, which attackers frequently use for remote access and command-and-control. The detection relies on process creation telemetry, specifically the process image name and the full command line content.

Reporting behind it

Related detections9 linkedT1572 — drag to rearrange
Suspicious SSH Reverse Tunnel Establishment (via process_creation)
Suspicious Cloudflared Tunnel Persistence Installed via msiexec (via process_creation)
Suspicious Renamed Tunneling Tool Executing from Windows Tasks Directory
Suspicious Reverse SSH Tunnel Creation with Host Key Verification Disabled (via process_creation)
Malicious Abyss Locker wmihelper SSH Backdoor Deployment (via file_event)
Malicious GS-Netcat Command and Control via Global Socket Relay Network (via dns_query)
Suspicious Microsoft Dev Tunnel Domain Resolution via DNS (via dns_query)
Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs
Suspicious SSH Reverse Tunnel Over DNS Port
Windows Process Command Lines Indicating ngrok.exe Tunnel Setup
Pivot detection · T1572 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.