Communication To Ngrok Tunneling Service - Linux
This rule detects outbound network connections to ngrok tunneling service endpoints. Ngrok is a legitimate tool that can be used to expose local servers to the internet, but it is also frequently leveraged by malicious actors for data exfiltration, command and control, and bypassing network restrictions. Detection of communication to these specific ngrok domains could indicate unauthorized use of the service for malicious purposes.
Sigma
