Ngrok Usage with Remote Desktop Service

Title: Ngrok Usage with Remote Desktop Service
Status: test
Description:Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour
References:
  -https://twitter.com/tekdefense/status/1519711183162556416?s=12&t=OTsHCBkQOTNs1k3USz65Zg
  -https://ngrok.com/
Author: Florian Roth (Nextron Systems)
Date: 2022-04-29
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.t1090'

Logsource:

• product: windows
• service: terminalservices-localsessionmanager

Detection:
  selection:
    EventID: '21'
    Address|contains: '16777216'
  condition:selection
Falsepositives:
  -Unknown
Level: high