Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
25 detections
Filters
Last updated
All Time
Detection languages
10
4
3
3
2
Contributors
7
4
3
2
2
Categories
15
12
6
5
3
Platforms
15
6
5
4
1
Products / Services
5
5
4
4
3
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
IDS Classtypes
2
IDS Protocols
2
Detects the execution of Ngrok, a legitimate utility often abused by threat actors for port forwarding and tunneling. This allows them to expose local services to the internet, bypassing firewalls and network restrictions. The rule specifically looks for common command-line arguments used with Ngrok, such as those for tunneling specific TCP ports (e.g., 139, 445, 3389, 5985, 5986), HTTP services, or configuration file usage.
Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Page 2 of 2