This article is part of a series of step-by-step incident guides created by the Sophos Rapid Response team to help incident responders and security-operations teams identify and remediate widely seen threat tools, techniques, and behaviors.<\/em><\/p>\n What Is Ngrok and How Is It Used by Threat Actors?<\/span><\/b>\u00a0<\/span><\/p>\n Ngrok is a cross-platform tool that exposes local network ports to the internet via secure tunneling.\u00a0 It provides secure tunnels between the internet and computer systems that exist behind a firewall or Network Access Translation (NAT) solution, and which use the Transmission Control Protocol (TCP). Once a port has been chosen as the desired communication channel, the necessary tunneling configurations are set up within the ngrok process. Ngrok\u2019s cloud services facilitate two-way network traffic that is relayed back to the running ngrok process and forwards the network traffic to the specified local port.<\/span>\u00a0<\/span><\/p>\n A limited version of the tool is freely available at <\/span>ngrok.com<\/span><\/a> for noncommercial use, and a fuller-fledged version\u00a0can be licensed for commercial use. Unfortunately, it also figures into various attack strategies when malicious actors use its tunneling capabilities to connect to command-and-control (C2) servers, download malicious code, and so forth while bypassing network protections.<\/span>\u00a0<\/span><\/p>\n Other likely reasons for its popularity with attackers include:\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n Incident Guide Context<\/span><\/b>\u00a0<\/span><\/p>\n This guide only addresses the investigation and mitigation of incidents involving the detection of ngrok on the network. <\/span>We strongly recommend that responders ascertain whether ngrok is in use on their network for legitimate purposes before proceeding with mitigation.<\/span><\/i>\u00a0<\/span><\/p>\n The guide uses features of\u202f<\/span>Sophos XDR<\/span><\/a>, <\/span>such as Live Discover and Live Response, to illustrate the steps defenders can take. Security professionals that are not using Sophos XDR but have access to other tools such as\u202f<\/span>OSQuery<\/span><\/a>\u202fcan adapt and apply the information to their needs.<\/span>\u00a0<\/span><\/p>\n Queries and commands referenced in the guide are some of the methods used by the\u202f<\/span>Sophos Rapid Response<\/span><\/a>\u202fteam during incident engagements. They are recommendations only; there will be other ways of accomplishing each task.<\/span>\u00a0<\/span><\/p>\n Any instructions to remove items should be double-checked to prevent the accidental removal of legitimate client configurations.<\/span>\u00a0<\/span><\/p>\n The goal of this section is to establish if there are any Indicators of Compromise (IOC) on the affected system that are related to ngrok. In subsequent sections we will provide steps to analyze and respond to the results of investigation. For purposes of illustration, we will draw on two separate response scenarios in these sections. We will occasionally use green<\/span> <\/b><\/span><\/span>text to draw attention to significant details.<\/span>\u00a0<\/span><\/p>\n Check for Live Processes<\/u><\/span><\/b>\u00a0<\/span><\/p>\n First, run a query on the network to check the currently running processes.\u00a0<\/span>\u00a0<\/span><\/p>\n Sophos XDR customers can create and run new Live Discover queries to do this. If you are new to Live Discover, the <\/span>help guide<\/span><\/a> can assist you in putting those together. The basic steps are as follows:<\/span>\u00a0<\/span><\/p>\n\n
Investigate<\/span><\/b>\u00a0<\/span><\/h3>\n
![](\"https:\/\/news.sophos.com\/wp-content\/uploads\/2022\/07\/122024889_m.jpg\"\/)
<\/p>\n