Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
25 detections
Filters
Last updated
All Time
Detection languages
10
4
3
3
2
Contributors
7
4
3
2
2
Categories
15
12
6
5
3
Platforms
15
6
5
4
1
Products / Services
5
5
4
4
3
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
IDS Classtypes
2
IDS Protocols
2
The following analytic detects the execution of ngrok.exe on a Windows operating system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because while ngrok is a legitimate tool for creating secure tunnels, it is increasingly used by adversaries to bypass network defenses and establish reverse proxies. If confirmed malicious, this could allow attackers to exfiltrate data, maintain persistence, or facilitate further attacks by tunneling traffic through the compromised system.
Detects the execution of known tunneling and reverse proxy tools (ngrok, cloudflared, localtunnel) commonly abused by adversaries to create outbound tunnels for C2, bypass firewalls, or exfiltrate data.
Detects execution of a generically-named a.out binary from a non-standard path (/tmp or Downloads) or any command line referencing ngrok, indicating an ngrok reverse-tunnel binary disguised under a default compiler output name.
Detects execution of a generically-named a.out binary from a non-standard path (/tmp or Downloads) or any command line referencing ngrok, indicating an ngrok reverse-tunnel binary disguised under a default compiler output name.
Detects outbound TLS traffic directed toward ngrok.io infrastructure originating from Azure Container Instances. Ngrok is frequently used by adversaries to establish reverse proxies and tunnels to maintain persistent command-and-control access to compromised cloud-hosted containers.
Detects outbound network traffic established to an *.ngrok.io domain, which is frequently used by adversaries to create secure tunnels for command and control (C2) or unauthorized data exfiltration.
Detects the execution and network activity of known reverse tunneling and proxy tools such as Chisel, Ngrok, and FRP. These tools are commonly abused by adversaries to establish persistence, bypass firewalls, and facilitate command and control (C2) communication. The rule monitors for specific process names, command-line arguments, and DNS requests related to these services.
Detects the execution and network activity of known reverse tunneling and proxy tools such as Chisel, Ngrok, and FRP. These tools are commonly abused by adversaries to establish persistence, bypass firewalls, and facilitate command and control (C2) communication. The rule monitors for specific process names, command-line arguments, and DNS requests related to these services.
This rule detects DNS queries to domains associated with tunneling tools (Ngrok, Tailscale) and Remote Monitoring and Management (RMM) tools (FleetDeck, TacticalRMM, Level.io, Pulseway, ScreenConnect, Splashtop, RustDesk, Atera, Remcos) known to be used by threat actors like Scattered Spider/Muddled Libra for covert persistent connectivity, remote access, and lateral movement. The rule categorizes the detected tools into 'Tunneling' or 'RMM'.
This rule detects HTTP GET requests containing '/api/device/gate/' and the 'ngrok-skip-browser-warning' string in either the AdditionalExtensions, RequestClientApplication, csUriQuery, or csUserAgent fields. This pattern is indicative of traffic associated with ngrok, a legitimate reverse proxy tool that can be leveraged by threat actors for various malicious purposes, including C2, data exfiltration, or bypassing network restrictions. The rule consolidates logs from CommonSecurityLog, W3CIISLog, and DeviceNetworkEvents to identify such activity.
Detects DNS queries to domains associated with tunneling tools (Ngrok, Tailscale) and Remote Monitoring and Management (RMM) tools (FleetDeck, TacticalRMM, Level.io, Pulseway, ScreenConnect, Splashtop, RustDesk, Atera, Remcos) known to be used by threat actors like Scattered Spider/Muddled Libra for covert persistent connectivity, remote access, and lateral movement.
Identifies potential network tunneling, proxying, and reverse shell activities by correlating process creation with outbound public network connections. This rule looks for known tunneling and proxy tool filenames and specific command-line arguments indicative of such activities, then correlates these process events with successful or attempted outbound network connections to public IP addresses.
Detects the execution of remote access, tunneling, and credential access tools from suspicious directories. This rule specifically targets tools commonly abused by threat actors like Scattered Spider, such as AnyDesk, TeamViewer, ngrok, Teleport, Tailscale, and Mimikatz, when executed from user-writable or temporary folders. It excludes legitimate installations in standard Program Files directories to reduce false positives.
This rule detects the creation of processes associated with various legitimate remote access and remote monitoring/management (RMM) tools. It specifically looks for common executable names and patterns for tools like AnyDesk, TeamViewer, ngrok, Splashtop, ScreenConnect, ConnectWise Control, Pulseway, TacticalRMM, Tailscale, and Level. The rule includes exclusions for specified administrative users and legitimate parent processes to reduce false positives. The primary goal is to identify potentially unauthorized or suspicious usage of these tools, which can be leveraged by adversaries for remote access, command and control, or data exfiltration.
Detects an executable initiating a network connection to "ngrok" domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
The analytic detects the use of Ngrok on a Linux operating system by monitoring process names and command-line arguments. Ngrok is a legitimate reverse proxy tool that can be used by adversaries to establish reverse proxies, potentially bypassing network defenses. If confirmed malicious, this could allow attackers to create persistent, unauthorized access channels, facilitating data exfiltration or further exploitation of the compromised system.
This analytic detects DNS queries to common Ngrok domains, indicating potential use of the Ngrok reverse proxy tool. It leverages the Network Resolution datamodel to identify queries to domains such as "*.ngrok.com" and "*.ngrok.io". While Ngrok usage is not inherently malicious, it has been increasingly adopted by adversaries for covert communication and data exfiltration. If confirmed malicious, this activity could allow attackers to bypass network defenses, establish persistent connections, and exfiltrate sensitive data, posing a significant threat to the network's security.
The following analytic detects the execution of ngrok.exe on a Windows operating system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because while ngrok is a legitimate tool for creating secure tunnels, it is increasingly used by adversaries to bypass network defenses and establish reverse proxies. If confirmed malicious, this could allow attackers to exfiltrate data, maintain persistence, or facilitate further attacks by tunneling traffic through the compromised system.
This rule detects outbound network connections to ngrok tunneling service endpoints. Ngrok is a legitimate tool that can be used to expose local servers to the internet, but it is also frequently leveraged by malicious actors for data exfiltration, command and control, and bypassing network restrictions. Detection of communication to these specific ngrok domains could indicate unauthorized use of the service for malicious purposes.
Detects cases where ngrok, a legitimate reverse proxy tool, is used to forward traffic to the local Remote Desktop Protocol (RDP) port. This activity can indicate malicious behavior, as adversaries often use tools like ngrok for command and control, bypassing firewalls, or establishing persistent remote access to compromised systems.
Page 1 of 2