Ngrok Reverse Proxy on Network ASIM DNS Solution

Back


Id	50b0dfb7-2c94-4eaf-a332-a5936d78c263
Rulename	Ngrok Reverse Proxy on Network (ASIM DNS Solution)
Description	This detection identifies the top four Ngrok domains from DNS resolution. Ngrok reverse proxy can bypass network defense. While not inherently harmful, it has been used for malicious activities recently.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1572 T1090 T1102
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/DNS Essentials/Analytic Rules/NgrokReverseProxyOnNetwork.yaml
Version	1.0.0
Arm template	50b0dfb7-2c94-4eaf-a332-a5936d78c263.json

KQL

// Define a list of Ngrok domains
let NgrokDomains = dynamic(["ngrok.com", "ngrok.io", "ngrok", "tunnel.com", "korgn", "lennut.com"]);
// Query the _Im_Dns function for the past 1 hour
_Im_Dns(starttime=ago(1h))
| where isnotempty(DnsQuery) // Filter out empty DNS queries
| where DnsQuery has_any (NgrokDomains) // Filter DNS queries that match any of the Ngrok domains
| summarize Starttime = min(EventStartTime),Endtime=max(EventEndTime),EventsCount=sum(EventCount),EventResults=make_set(EventResult,4) by DnsQuery, Domain, SrcIpAddr, Dvc
// Summarize the data by Domain, DNS query, source IP address, and device Dvc

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/DNS Essentials/Analytic Rules/NgrokReverseProxyOnNetwork.yaml
requiredDataConnectors: []
name: Ngrok Reverse Proxy on Network (ASIM DNS Solution)
entityMappings:
- fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: Domain
    identifier: DomainName
  entityType: DNS
id: 50b0dfb7-2c94-4eaf-a332-a5936d78c263
tags:
- Schema: ASimDns
  SchemaVersion: 0.1.6
description: |
    'This detection identifies the top four Ngrok domains from DNS resolution. Ngrok reverse proxy can bypass network defense. While not inherently harmful, it has been used for malicious activities recently.'
tactics:
- CommandAndControl
triggerThreshold: 0
kind: Scheduled
eventGroupingSettings:
  aggregationKind: AlertPerResult
query: |
  // Define a list of Ngrok domains
  let NgrokDomains = dynamic(["ngrok.com", "ngrok.io", "ngrok", "tunnel.com", "korgn", "lennut.com"]);
  // Query the _Im_Dns function for the past 1 hour
  _Im_Dns(starttime=ago(1h))
  | where isnotempty(DnsQuery) // Filter out empty DNS queries
  | where DnsQuery has_any (NgrokDomains) // Filter DNS queries that match any of the Ngrok domains
  | summarize Starttime = min(EventStartTime),Endtime=max(EventEndTime),EventsCount=sum(EventCount),EventResults=make_set(EventResult,4) by DnsQuery, Domain, SrcIpAddr, Dvc
  // Summarize the data by Domain, DNS query, source IP address, and device Dvc  
triggerOperator: gt
status: Available
queryPeriod: 1h
queryFrequency: 1h
version: 1.0.0
severity: Medium
relevantTechniques:
- T1572
- T1090
- T1102

ARM