Communication To Ngrok Tunneling Service Initiated

Title: Communication To Ngrok Tunneling Service Initiated
Status: test
Description:Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
References:
  -https://twitter.com/hakluke/status/1587733971814977537/photo/1
  -https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent
Author: Florian Roth (Nextron Systems)
Date: 2022-11-03
modified:2024-02-02
Tags:

• -'attack.exfiltration'
• -'attack.command-and-control'
• -'attack.t1567'
• -'attack.t1568.002'
• -'attack.t1572'
• -'attack.t1090'
• -'attack.t1102'
• -'attack.s0508'

Logsource:

• category: network_connection
• product: windows

Detection:
  selection:
    DestinationHostname|contains:
      -'tunnel.us.ngrok.com'
      -'tunnel.eu.ngrok.com'
      -'tunnel.ap.ngrok.com'
      -'tunnel.au.ngrok.com'
      -'tunnel.sa.ngrok.com'
      -'tunnel.jp.ngrok.com'
      -'tunnel.in.ngrok.com'

  condition:selection
Falsepositives:
  -Legitimate use of the ngrok service.
Level: high