Skip to content
Threat Feed
Subscribe
medium advisory

Ngrok Tunneling Service Usage on Linux

This brief documents the detection of outbound network connections to ngrok tunneling infrastructure, which can be utilized for unauthorized remote access or data exfiltration.

Triage facts

Revision 1
Evidence
Unknown
Severity
Medium
Action
Monitor or close
Sources
1 public source
Freshness
Revision 1Nov 10, 03:34 UTC
Detection
1 rule
Source quality
B2Likely

Ngrok is a legitimate tool often used for exposing local services to the internet via secure tunnels. Threat actors may leverage ngrok to establish unauthorized Command and Control (C2) channels or exfiltrate data from compromised Linux environments. This detection focuses on identifying network connections originating from within the environment to known ngrok tunneling service endpoints.

Recommendation

  • Deploy the Sigma rule below to detect outbound connectivity to ngrok tunneling domains.
  • Establish a baseline for authorized ngrok usage within the organization to reduce noise.
  • Utilize network-layer telemetry to audit processes initiating connections to ngrok infrastructure.

Threat Hunt

Identify processes making outbound connections to *.ngrok.com

T1567 medium medium confidence convert to detection

Data: Netflow or process-to-destination network logs

Detection coverage 1

Detect Outbound Connection to Ngrok

medium

Detects processes establishing outbound connections to known ngrok tunnel endpoints

sigma tactics: command_and_control, exfiltration techniques: T1567, T1572 sources: network_connection, linux

Detection queries are available on the platform. Get full rules →