ngrok publishes a local service on a public hostname through an outbound connection to its cloud, which makes it attractive for exposing RDP, SSH or an internal web shell without any inbound firewall change. The agent, its configuration file and its domains are all observable, so the work is scoping which hosts are allowed to run it.
Signals at a Glance
| Signal | Where | ATT&CK |
|---|---|---|
| ngrok.exe or ngrok binary executing with tcp, http or authtoken arguments | Sysmon 1, 4688, EDR | T1572 |
| ngrok.yml created under the user profile | Sysmon 11, EDR file events | T1572 |
| DNS or proxy requests to tunnel.ngrok.com and ngrok tunnel domains | DNS, proxy, EDR | T1090 |
| Outbound connections to N.tcp.ngrok.io tunnel endpoints | Firewall, Zeek | T1572 |
| Ngrok running as a service or scheduled task on a server | Service and task logs | T1090 |
Domain and Egress Detection
The agent keeps a control connection to ngrok’s service and publishes tunnels on ngrok-owned hostnames, including TCP endpoints of the form N.tcp.ngrok.io. Where your estate has no sanctioned use, any resolution of those domains from a server is worth an alert. The query below summarises by device and initiating process:
// Microsoft Defender XDR (KQL) - ngrok domain egress
DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemoteUrl has_any ("ngrok.io", "ngrok-free.app", "ngrok.app", "tunnel.ngrok.com")
| summarize conns=count(), first=min(Timestamp), last=max(Timestamp),
urls=make_set(RemoteUrl, 10)
by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
| order by conns desc
// tune/validate: exclude the developer groups that have an approved ngrok
// licence; servers and domain controllers should never appear here.
Agent and Config Artifacts
On the host the agent writes a configuration file containing the authtoken, and operators commonly run it with an explicit TCP tunnel to a management port. Both are good Sigma targets:
title: ngrok TCP Tunnel To Management Port
logsource:
category: process_creation
detection:
selection_img:
Image|endswith:
- '\ngrok.exe'
- '/ngrok'
selection_args:
CommandLine|contains:
- ' tcp 3389'
- ' tcp 22'
- ' tcp 445'
- ' tcp 5985'
- 'authtoken'
condition: selection_img and selection_args
level: high
# tune/validate: operators rename ngrok.exe, so add a rule keyed on the
# OriginalFileName / hash and on ngrok.yml file creation.
- Alert on file creation of
ngrok.ymlunder user profile configuration directories on non-developer hosts. - Block or alert on ngrok domains at the DNS resolver; a sinkhole gives you a source host list even when the agent is renamed.
- Review exposed services: a tunnel to port 3389, 22 or 445 is an unauthenticated route in from the Internet unless edge policies were configured.
- Hunt for persistence: an agent started from a scheduled task or service is deliberate, not a developer experiment.
Use SigmaHQ rules for ngrok and tunneling tool execution, Elastic and Splunk ESCU content for remote access tooling, and your DNS and proxy logs. Always baseline your own environment — ngrok has real developer use, so allow-list by user group and host role rather than blocking outright.
Build Detections That Fire
Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.
- Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
- Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
- 24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts