🐾 - 🚨 Ngrok SSL Tunnel opened - Local network Linux 🐧 machine exposed on internet 🌐 - Possible file exfiltration 🗃 - Tool liked by Daixin Team 👿 - Suricata Rule 3300218 (pawpatrules)

🐾 - 🚨 Ngrok SSL Tunnel opened - Local network Linux 🐧 machine exposed on internet 🌐 - Possible file exfiltration 🗃 - Tool liked by Daixin Team 👿

SID: 3300218Rev: 20 views

Sourcepawpatrules

CreatedOctober 21, 2022

UpdatedAugust 24, 2023

Classificationpolicy-violation

alert tls $HOME_NET any -> any any (msg:"🐾 - 🚨 Ngrok SSL Tunnel opened - Local network Linux 🐧 machine exposed on internet 🌐 - Possible file exfiltration 🗃 - Tool liked by Daixin Team 👿"; flow:to_server, stateless; ja3.hash; content:"473cd7cb9faa642487833865d516e578"; fast_pattern; tls_sni; content:"tunnel.ngrok.com"; metadata:former_category JA3; reference:url,https://ngrok.com/download; reference:url,https://www.cisa.gov/uscert/ncas/alerts/aa22-294a; metadata:created_at 2022_10_21, updated_at 2023_08_24; sid:3300218; rev:2; classtype:policy-violation;)

References

url	https://ngrok.com/download
url	https://www.cisa.gov/uscert/ncas/alerts/aa22-294a

🐾 - 🚨 Ngrok SSL Tunnel opened - Local network Linux 🐧 machine exposed on internet 🌐 - Possible file exfiltration 🗃 - Tool liked by Daixin Team 👿

References

Metadata

Comments (0)