🐾 - 🚨 Ngrok SSL Tunnel opened - Local network machine exposed on internet 🌐 - Possible file exfiltration 🗃 - Tool liked by Daixin Team 👿 - Suricata Rule 3300219 (pawpatrules)

🐾 - 🚨 Ngrok SSL Tunnel opened - Local network machine exposed on internet 🌐 - Possible file exfiltration 🗃 - Tool liked by Daixin Team 👿

SID: 3300219Rev: 10 views

Sourcepawpatrules

CreatedOctober 21, 2022

UpdatedOctober 21, 2022

Classificationpolicy-violation

alert tls $HOME_NET any -> any any (msg:"🐾 - 🚨 Ngrok SSL Tunnel opened - Local network machine exposed on internet 🌐 - Possible file exfiltration 🗃 - Tool liked by Daixin Team 👿"; flow:to_server, stateless; tls_sni; content:"tunnel.ngrok.com"; reference:url,https://ngrok.com/download; reference:url,https://www.cisa.gov/uscert/ncas/alerts/aa22-294a; metadata:created_at 2022_10_21, updated_at 2022_10_21; sid:3300219; rev:1; classtype:policy-violation;)

References

url	https://ngrok.com/download
url	https://www.cisa.gov/uscert/ncas/alerts/aa22-294a

🐾 - 🚨 Ngrok SSL Tunnel opened - Local network machine exposed on internet 🌐 - Possible file exfiltration 🗃 - Tool liked by Daixin Team 👿

References

Metadata

Comments (0)