{"id":"ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31","title":"PUA - Ngrok Execution","description":"Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available.\nInvolved domains are bin.equinox.io for download and *.ngrok.io for connections.\n","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-05-14","modified":"2023-02-21","tags":["attack.command-and-control","attack.t1572"],"technique_ids":["T1572"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Another tool that uses the command line switches of Ngrok","Ngrok http 3978 (https://learn.microsoft.com/en-us/azure/bot-service/bot-service-debug-channel-ngrok?view=azure-bot-service-4.0)"],"references":["https://ngrok.com/docs","https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html","https://stackoverflow.com/questions/42442320/ssh-tunnel-to-ngrok-and-initiate-rdp","https://www.virustotal.com/gui/file/58d21840d915aaf4040ceb89522396124c82f325282f805d1085527e1e2ccfa1/detection","https://cybleinc.com/2021/02/15/ngrok-platform-abused-by-hackers-to-deliver-a-new-wave-of-phishing-attacks/","https://twitter.com/xorJosh/status/1598646907802451969","https://www.softwaretestinghelp.com/how-to-use-ngrok/"],"source_path":"rules/windows/process_creation/proc_creation_win_pua_ngrok.yml","source_sha256":"c98dfa2de5ae3711e4936377a45de9f3a1da2b6166c602b12555c8e1cdc7bc24","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_ngrok.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PUA - Ngrok Execution\nid: ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31\nstatus: test\ndescription: |\n  Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available.\n  Involved domains are bin.equinox.io for download and *.ngrok.io for connections.\nreferences:\n    - https://ngrok.com/docs\n    - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html\n    - https://stackoverflow.com/questions/42442320/ssh-tunnel-to-ngrok-and-initiate-rdp\n    - https://www.virustotal.com/gui/file/58d21840d915aaf4040ceb89522396124c82f325282f805d1085527e1e2ccfa1/detection\n    - https://cybleinc.com/2021/02/15/ngrok-platform-abused-by-hackers-to-deliver-a-new-wave-of-phishing-attacks/\n    - https://twitter.com/xorJosh/status/1598646907802451969\n    - https://www.softwaretestinghelp.com/how-to-use-ngrok/\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-05-14\nmodified: 2023-02-21\ntags:\n    - attack.command-and-control\n    - attack.t1572\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection1:\n        CommandLine|contains:\n            - ' tcp 139'\n            - ' tcp 445'\n            - ' tcp 3389'\n            - ' tcp 5985'\n            - ' tcp 5986'\n    selection2:\n        CommandLine|contains|all:\n            - ' start '\n            - '--all'\n            - '--config'\n            - '.yml'\n    selection3:\n        Image|endswith: 'ngrok.exe'\n        CommandLine|contains:\n            - ' tcp '\n            - ' http '\n            - ' authtoken '\n    selection4:\n        CommandLine|contains:\n            - '.exe authtoken '\n            - '.exe start --all'\n    condition: 1 of selection*\nfalsepositives:\n    - Another tool that uses the command line switches of Ngrok\n    - Ngrok http 3978 (https://learn.microsoft.com/en-us/azure/bot-service/bot-service-debug-channel-ngrok?view=azure-bot-service-4.0)\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1572","id":"T1572","name":"Protocol Tunneling","page":"techniques/enterprise/T1572/"}],"data_path":"data/detection-rules/ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31.json","kind":"sigma"}