Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
107 detections
Filters
Last updated
All Time
Detection languages
43
29
15
8
4
Contributors
24
23
9
8
6
Categories
54
47
47
34
21
Platforms
54
47
11
11
4
Products / Services
30
30
26
15
9
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
1
IDS Classtypes
18
10
IDS Protocols
10
9
9
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Page 6 of 6