🐾 - 🚨 Ngrok SSL Tunnel opened - Local network machine exposed on internet 🌐 - Possible file exfiltration 🗃 - Tool liked by Daixin Team 👿 - Suricata Rule 3300220 (pawpatrules)

🐾 - 🚨 Ngrok SSL Tunnel opened - Local network machine exposed on internet 🌐 - Possible file exfiltration 🗃 - Tool liked by Daixin Team 👿

SID: 3300220Rev: 10 views

Sourcepawpatrules

CreatedAugust 24, 2023

UpdatedAugust 24, 2023

Classificationpolicy-violation

alert tls $HOME_NET any -> any any (msg:"🐾 - 🚨 Ngrok SSL Tunnel opened - Local network machine exposed on internet 🌐 - Possible file exfiltration 🗃 - Tool liked by Daixin Team 👿"; flow:to_server, stateless; tls_sni; content:"connect.ngrok-agent.com"; reference:url,https://ngrok.com/download; reference:url,https://www.cisa.gov/uscert/ncas/alerts/aa22-294a; metadata:created_at 2023_08_24, updated_at 2023_08_24; sid:3300220; rev:1; classtype:policy-violation;)

References

url	https://ngrok.com/download
url	https://www.cisa.gov/uscert/ncas/alerts/aa22-294a

🐾 - 🚨 Ngrok SSL Tunnel opened - Local network machine exposed on internet 🌐 - Possible file exfiltration 🗃 - Tool liked by Daixin Team 👿

References

Metadata

Comments (0)