Is my host protected against ngrok?
Tactic: Command-and-control
Ngrok is a reverse proxy tool that provides secure tunnels over the Internet. Adversaries may use ngrok to tunnel traffic to their command and control servers. It's important to monitor for the presence of ngrok, as it may be used to bypass network security controls. This chain requires an ngrok account. The ngrok.token fact must be set to your ngrok token available in the ngrok dashboard. Warning: This TTP will expose the host to the Internet.
View Command
To view this TTPs command, you must be logged in with a professional or enterprise license.
LoginTest this TTP
Download Operator (1.7.1)
Test this TTP using one of our Operator chainsStage and execute ngrok.
Is my host protected against ngrok?
2022-12-13
Follow @preludeorg on Twitter for new chains and more.
Join the Prelude Discord to discuss chains and more.
Keep up to date with code changes and community activity on Github