cscli scenarios install sigmahq/proc_creation_win_pua_ngrok1type: trigger2name: sigmahq/proc_creation_win_pua_ngrok3description: |4 Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections.5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.CommandLine contains ' tcp 139' || evt.Parsed.CommandLine contains ' tcp 445' || evt.Parsed.CommandLine contains ' tcp 3389' || evt.Parsed.CommandLine contains ' tcp 5985' || evt.Parsed.CommandLine contains ' tcp 5986' || evt.Parsed.CommandLine contains ' start ' && evt.Parsed.CommandLine contains '--all' && evt.Parsed.CommandLine contains '--config' && evt.Parsed.CommandLine contains '.yml' || evt.Parsed.Image endsWith 'ngrok.exe' && (evt.Parsed.CommandLine contains ' tcp ' || evt.Parsed.CommandLine contains ' http ' || evt.Parsed.CommandLine contains ' authtoken ') || evt.Parsed.CommandLine contains '.exe authtoken ' || evt.Parsed.CommandLine contains '.exe start --all')7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t15721516 label: "PUA - Ngrok Execution"17 behavior : "windows:audit"18 remediation: false1920scope:21 type: ParentProcessId22 expression: evt.Parsed.ParentProcessId2324