Process Initiated Network Connection To Ngrok Domain

Severity: high
Author: Florian Roth (Nextron Systems)
Source: upstream

Detects an executable initiating a network connection to "ngrok" domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1102` Web Service, `T1572` Protocol Tunneling
Exfiltration	`T1567` Exfiltration Over Web Service

Event coverage

Provider	Event ID	Title
Sysmon	3	Network connection

Stages and Predicates

Stage 1: `selection`

or:
DestinationHostname|endswith: .ngrok-free.app
DestinationHostname|endswith: .ngrok-free.dev
DestinationHostname|endswith: .ngrok.app
DestinationHostname|endswith: .ngrok.dev
DestinationHostname|endswith: .ngrok.io
Initiated: true

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.