Process Initiated Network Connection To Ngrok Domain
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects an executable initiating a network connection to ngrok domains. Attackers were seen using this ngrok in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_network_connection" AND IS_INITIATED = "true" AND DESTINATIONHOST endswith ".ngrok-free.app,.ngrok-free.dev,.ngrok.app,.ngrok.dev,.ngrok.io" select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.PROCESSNAME,Action1.DESTINATIONHOST,Action1.DESTINATION_IPV6,Action1.DEST_IP,Action1.SOURCEHOST,Action1.SOURCE_IP,Action1.SOURCE_IPV6
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Florian Roth (Nextron Systems)
