1200KM / sigma-rule
Ngrok Usage with Remote Desktop Service — Sigma Rule
Sigma rule 64d51a51-32a6-49f0-9f3d-17e34d640272. Ngrok Usage with Remote Desktop Service — Sigma Rule. Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour
Rule metadata and linked tags
Author: Florian Roth (Nextron Systems). Source status: test; severity: high. Source dates: 2022-04-29 / not supplied.
{
"product": "windows",
"service": "terminalservices-localsessionmanager"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: 815692c6aad1c2feef4d71bd6e7ea0d8033c86eb8038b3c0a33e7890b1cafc5d
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Ngrok Usage with Remote Desktop Service
id: 64d51a51-32a6-49f0-9f3d-17e34d640272
status: test
description: Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour
references:
- https://twitter.com/tekdefense/status/1519711183162556416?s=12&t=OTsHCBkQOTNs1k3USz65Zg
- https://ngrok.com/
author: Florian Roth (Nextron Systems)
date: 2022-04-29
tags:
- attack.command-and-control
- attack.t1090
logsource:
product: windows
service: terminalservices-localsessionmanager
detection:
selection:
EventID: 21
Address|contains: '16777216'
condition: selection
falsepositives:
- Unknown
level: high
False positives
- Unknown
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.