Possible Command and Control via Ngrok Tunneling Service
Ngrok is a legitimate tool that creates secure tunnels to localhost servers through NAT/firewalls, often used by developers. Additionally, Ngrok tunnels have been used by Iranian APT groups, among others, to support their operations particularly for Command and Control (C2), data exfiltration, and initial access staging.
Microsoft Sentinel (KQL)
