{"id":"18249279-932f-45e2-b37a-8925f2597670","title":"Process Initiated Network Connection To Ngrok Domain","description":"Detects an executable initiating a network connection to \"ngrok\" domains.\nAttackers were seen using this \"ngrok\" in order to store their second stage payloads and malware.\nWhile communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.\n","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-07-16","modified":"2025-07-30","tags":["attack.exfiltration","attack.command-and-control","attack.t1567","attack.t1572","attack.t1102"],"technique_ids":["T1102","T1567","T1572"],"logsource":{"category":"network_connection","product":"windows"},"falsepositives":["Legitimate use of the ngrok service."],"references":["https://ngrok.com/","https://ngrok.com/blog-post/new-ngrok-domains","https://www.virustotal.com/gui/file/cca0c1182ac114b44dc52dd2058fcd38611c20bb6b5ad84710681d38212f835a/","https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf"],"source_path":"rules/windows/network_connection/net_connection_win_domain_ngrok.yml","source_sha256":"bc90fa17332e4377c315373977106a87edb2cb9a1c1bac8528ca367c4754a267","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_domain_ngrok.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Process Initiated Network Connection To Ngrok Domain\nid: 18249279-932f-45e2-b37a-8925f2597670\nrelated:\n    - id: 1d08ac94-400d-4469-a82f-daee9a908849\n      type: similar\nstatus: test\ndescription: |\n    Detects an executable initiating a network connection to \"ngrok\" domains.\n    Attackers were seen using this \"ngrok\" in order to store their second stage payloads and malware.\n    While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.\nreferences:\n    - https://ngrok.com/\n    - https://ngrok.com/blog-post/new-ngrok-domains\n    - https://www.virustotal.com/gui/file/cca0c1182ac114b44dc52dd2058fcd38611c20bb6b5ad84710681d38212f835a/\n    - https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-07-16\nmodified: 2025-07-30\ntags:\n    - attack.exfiltration\n    - attack.command-and-control\n    - attack.t1567\n    - attack.t1572\n    - attack.t1102\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        Initiated: 'true'\n        DestinationHostname|endswith:\n            - '.ngrok-free.app'\n            - '.ngrok-free.dev'\n            - '.ngrok.app'\n            - '.ngrok.dev'\n            - '.ngrok.io'\n    condition: selection\nfalsepositives:\n    - Legitimate use of the ngrok service.\n# Note: The level of this rule is related to your internal policy.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1102","id":"T1102","name":"Web Service","page":"techniques/enterprise/T1102/"},{"key":"enterprise/T1567","id":"T1567","name":"Exfiltration Over Web Service","page":"techniques/enterprise/T1567/"},{"key":"enterprise/T1572","id":"T1572","name":"Protocol Tunneling","page":"techniques/enterprise/T1572/"}],"data_path":"data/detection-rules/18249279-932f-45e2-b37a-8925f2597670.json","kind":"sigma"}