{"id":"19bf6fdb-7721-4f3d-867f-53467f6a5db6","title":"Communication To Ngrok Tunneling Service - Linux","description":"Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-11-03","modified":"","tags":["attack.exfiltration","attack.command-and-control","attack.t1567","attack.t1568.002","attack.t1572","attack.t1090","attack.t1102","attack.s0508"],"technique_ids":["T1090","T1102","T1567","T1568.002","T1572"],"logsource":{"product":"linux","category":"network_connection"},"falsepositives":["Legitimate use of ngrok"],"references":["https://twitter.com/hakluke/status/1587733971814977537/photo/1","https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent"],"source_path":"rules/linux/network_connection/net_connection_lnx_ngrok_tunnel.yml","source_sha256":"c3466742b9092eed5b8296d6fe4bdf77fa287ca8cc6ef394f833ba170e388015","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/network_connection/net_connection_lnx_ngrok_tunnel.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Communication To Ngrok Tunneling Service - Linux\nid: 19bf6fdb-7721-4f3d-867f-53467f6a5db6\nstatus: test\ndescription: Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors\nreferences:\n    - https://twitter.com/hakluke/status/1587733971814977537/photo/1\n    - https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-11-03\ntags:\n    - attack.exfiltration\n    - attack.command-and-control\n    - attack.t1567\n    - attack.t1568.002\n    - attack.t1572\n    - attack.t1090\n    - attack.t1102\n    - attack.s0508\nlogsource:\n    product: linux\n    category: network_connection\ndetection:\n    selection:\n        DestinationHostname|contains:\n            - 'tunnel.us.ngrok.com'\n            - 'tunnel.eu.ngrok.com'\n            - 'tunnel.ap.ngrok.com'\n            - 'tunnel.au.ngrok.com'\n            - 'tunnel.sa.ngrok.com'\n            - 'tunnel.jp.ngrok.com'\n            - 'tunnel.in.ngrok.com'\n    condition: selection\nfalsepositives:\n    - Legitimate use of ngrok\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1090","id":"T1090","name":"Proxy","page":"techniques/enterprise/T1090/"},{"key":"enterprise/T1102","id":"T1102","name":"Web Service","page":"techniques/enterprise/T1102/"},{"key":"enterprise/T1567","id":"T1567","name":"Exfiltration Over Web Service","page":"techniques/enterprise/T1567/"},{"key":"enterprise/T1568.002","id":"T1568.002","name":"Domain Generation Algorithms","page":"techniques/enterprise/T1568.002/"},{"key":"enterprise/T1572","id":"T1572","name":"Protocol Tunneling","page":"techniques/enterprise/T1572/"}],"data_path":"data/detection-rules/19bf6fdb-7721-4f3d-867f-53467f6a5db6.json","kind":"sigma"}