Communication To Ngrok Tunneling Service Initiated

Hunt Hypothesis

Detects an executable initiating a network connection to “ngrok” tunneling domains. Attackers were seen using this “ngrok” in order to store their second stage payloads and malware. While communicatio

Detection Rule

Sigma (Original)

title: Communication To Ngrok Tunneling Service Initiated
id: 1d08ac94-400d-4469-a82f-daee9a908849
related:
    - id: 18249279-932f-45e2-b37a-8925f2597670
      type: similar
status: test
description: |
    Detects an executable initiating a network connection to "ngrok" tunneling domains.
    Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
    While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
references:
    - https://twitter.com/hakluke/status/1587733971814977537/photo/1
    - https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent
author: Florian Roth (Nextron Systems)
date: 2022-11-03
modified: 2024-02-02
tags:
    - attack.exfiltration
    - attack.command-and-control
    - attack.t1567
    - attack.t1568.002
    - attack.t1572
    - attack.t1090
    - attack.t1102
    - attack.s0508
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'tunnel.us.ngrok.com'
            - 'tunnel.eu.ngrok.com'
            - 'tunnel.ap.ngrok.com'
            - 'tunnel.au.ngrok.com'
            - 'tunnel.sa.ngrok.com'
            - 'tunnel.jp.ngrok.com'
            - 'tunnel.in.ngrok.com'
    condition: selection
falsepositives:
    - Legitimate use of the ngrok service.
level: high

KQL (Azure Sentinel)

imNetworkSession
| where DstHostname contains "tunnel.us.ngrok.com" or DstHostname contains "tunnel.eu.ngrok.com" or DstHostname contains "tunnel.ap.ngrok.com" or DstHostname contains "tunnel.au.ngrok.com" or DstHostname contains "tunnel.sa.ngrok.com" or DstHostname contains "tunnel.jp.ngrok.com" or DstHostname contains "tunnel.in.ngrok.com"

Required Data Sources

False Positive Guidance

• Legitimate use of the ngrok service.

MITRE ATT&CK Context

• Tactic: Exfiltration
• Tactic: Command and Control
• Technique: T1567 — T1567
• Technique: T1568.002 — T1568.002
• Technique: T1572 — T1572
• Technique: T1090 — T1090
• Technique: T1102 — T1102

References

• https://twitter.com/hakluke/status/1587733971814977537/photo/1
• https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent
• SigmaHQ Rule