Query: alert when Detects an executable initiating a network connection to "ngrok" domains. Attackers were seen using this "ngrok" in orde
Matching passage: Sigma rule: Detects an executable initiating a network connection to "ngrok" domains. Attackers were seen using this "ngrok" in orde. Logsource: windows / network_connection. Rule: title: Process Initiated Network Connection To Ngrok Domain id: 18249279-932f-45e2-b37a-8925f2597670 related: - id: 1d08ac94-400d-4469-a82f-daee9a908849 type: similar status: test description: 'Detects an executable initiating a network connection to "ngrok" domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download. ' references: - https://ngrok.com/ - https://ngrok.com/blog-post/new-ngrok-domains - https://www.virustotal.com/gui/file/cca0c1182ac114b44dc52dd2058fcd38611c20bb6b5ad84710681d38212f835a/ - https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf author: Florian Roth (Nextron Systems) date: 2022-07-16 modified: 2025-07-30 tags: - attack.exfiltration - attack.command-and-control - attack.t1567 - attack.t1572 - attack.t1102 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: - .ngrok-free.app - .ngrok-free.dev - .ngrok.app - .ngrok.dev - .ngrok.io condition: selection falsepositives: - Legitimate use of the ngrok service. level: high
Near-miss passage: Sigma rule: Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. Anti-Malware. Logsource: windows / registry_set. Rule: title: AMSI Disabled via Registry Modification id: aa37cbb0-da36-42cb-a90f-fdf216fc7467 related: - id: 7dbbcac2-57a0-45ac-b306-ff30a8bd2981 type: similar status: experimental description: 'Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. Anti-Malware Scan Interface (AMSI) is a security feature in Windows that allows applications and services to integrate with anti-malware products for enhanced protection against malicious content. Adversaries may attempt to disable AMSI to evade detection by security software, allowing them to execute malicious scripts or code without being scanned. ' references: - https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d - https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal - https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-25 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Software\Microsoft\Windows Script\Settings\AmsiEnable Details: DWORD (0x00000000) condition: selection falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_amsi_disable/info.yml simulation: - type: atomic-red-team name: AMSI Bypass - Create AMSIEnable Reg Key technique: T1562.001 atomic_guid: 728eca7b-0444-4f6f-ac36-437e3d751dc0