EvilTokens Bot-Gate Analyst/Bot Detection via /api/device/gate/ with ngrok-skip-browser-warning Header

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•3

This rule detects HTTP GET requests containing '/api/device/gate/' and the 'ngrok-skip-browser-warning' string in either the AdditionalExtensions, RequestClientApplication, csUriQuery, or csUserAgent fields. This pattern is indicative of traffic associated with ngrok, a legitimate reverse proxy tool that can be leveraged by threat actors for various malicious purposes, including C2, data exfiltration, or bypassing network restrictions. The rule consolidates logs from CommonSecurityLog, W3CIISLog, and DeviceNetworkEvents to identify such activity.