Rule Info
Name
Communication To Ngrok Tunneling Service Initiated
Author
Florian Roth (Nextron Systems)
Description
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Date
2022-11-03 00:00:00
Modified
2024-02-02 00:00:00
Id
1d08ac94-400d-4469-a82f-daee9a908849
Tags
attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
Nasreddine Bencherchali
Merge PR #4702 from @nasbench - Rule tuning and updates
2024-02-12
Florian Roth
Update rules/windows/network_connection/net_connection_win_ngrok_tunnel.yml
2022-11-04
Scan your endpoints, forensic images or collected files with our portable scanner THOR