🐾 - 🚨 Ngrok SSL Tunnel opened - Local network Windows 🪟 machine exposed on internet 🌐 - Possible file exfiltration 🗃 - Tool liked by Daixin Team 👿 - Suricata Rule 3300216 (pawpatrules)

🐾 - 🚨 Ngrok SSL Tunnel opened - Local network Windows 🪟 machine exposed on internet 🌐 - Possible file exfiltration 🗃 - Tool liked by Daixin Team 👿

SID: 3300216Rev: 20 views

Sourcepawpatrules

CreatedOctober 21, 2022

UpdatedAugust 24, 2023

Classificationpolicy-violation

alert tls $HOME_NET any -> any any (msg:"🐾 - 🚨 Ngrok SSL Tunnel opened - Local network Windows 🪟 machine exposed on internet 🌐 - Possible file exfiltration 🗃 - Tool liked by Daixin Team 👿"; flow:to_server, stateless; ja3.hash; content:"6b28b80dd90355a0302cad8f014988b9"; fast_pattern; tls_sni; content:"tunnel.ngrok.com"; metadata:former_category JA3; reference:url,https://ngrok.com/download; reference:url,https://www.cisa.gov/uscert/ncas/alerts/aa22-294a; metadata:created_at 2022_10_21, updated_at 2023_08_24; sid:3300216; rev:2; classtype:policy-violation;)

References

url	https://ngrok.com/download
url	https://www.cisa.gov/uscert/ncas/alerts/aa22-294a

🐾 - 🚨 Ngrok SSL Tunnel opened - Local network Windows 🪟 machine exposed on internet 🌐 - Possible file exfiltration 🗃 - Tool liked by Daixin Team 👿

References

Metadata

Comments (0)