Listen to this Post
Introduction:
A recent social media observation has revealed a critical inconsistency in modern endpoint protection. Microsoft Defender for Endpoint automatically quarantines the popular tunneling tool ngrok when downloaded as a ZIP file, yet allows its installation without alert when deployed via the official Windows Package Manager (winget). This dichotomy exposes a fundamental reliance on installation source over behavioral analysis, creating a potential bypass for determined threat actors.
Learning Objectives:
- Understand how application reputation and source scoring influence modern EDR and antivirus decisions.
- Learn to craft detection rules that focus on tool behavior and network artifacts, not just installation methods.
- Develop strategies to harden environments against legitimate tool abuse, regardless of distribution channel.
You Should Know:
1. Querying for Winget Installations
Verified KQL query for Microsoft Defender for Endpoint to detect ngrok installations via winget:
DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName =~ "winget.exe"
| where ProcessCommandLine has_all ("install", "ngrok")
Step-by-step guide:
This Kusto Query Language (KQL) query hunts for execution events where the winget.exe process is used with command-line arguments containing both “install” and “ngrok”. Run this in Microsoft 365 Defender’s Advanced Hunting to identify systems where ngrok was installed via the package manager, a method that often bypasses traditional file-based detection.
2. Detecting ngrok Execution and Tunnels
Verified PowerShell command to detect active ngrok processes and their network connections:
Get-Process -Name "ngrok" -ErrorAction SilentlyContinue | ForEach-Object { Get-NetTCPConnection -OwningProcess $_.Id -ErrorAction SilentlyContinue }
Step-by-step guide:
This PowerShell one-liner first retrieves any running processes named “ngrok”, then enumerates all active TCP connections owned by those processes. This is crucial for identifying established tunnels, as ngrok’s primary function is to create persistent network connections to external servers, which could be used for data exfiltration or persistent access.
3. Blocking ngrok via AppLocker
Verified AppLocker rule to block ngrok execution regardless of source:
<RuleCollection Type="Exe"> <FilePathRule Id="abcdefab-1234-5678-abcd-abcdef123456" Name="Block ngrok" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"> <Conditions> <FilePathCondition Path="C:\\ngrok.exe" /> </Conditions> </FilePathRule> </RuleCollection>
Step-by-step guide:
Create an AppLocker policy in Group Policy Editor (gpedit.msc) or via security policy to explicitly deny execution of ngrok.exe from any location. This rule blocks the binary whether installed via winget, extracted from ZIP, or copied from removable media, providing consistent protection.
4. Network-Based ngrok Detection
Verified Suricata/Snort rule to detect ngrok network traffic:
alert tcp any any -> any any (msg:"SUSPICIOUS - Potential ngrok Tunnel Activity"; flow:established; content:"ngrok"; http_host; content:"Tunnel session"; http_header; classtype:network-scan; sid:1000001; rev:1;)
Step-by-step guide:
Deploy this network intrusion detection rule to monitor for ngrok’s characteristic network signatures. The rule triggers on HTTP hosts containing “ngrok” and headers with “Tunnel session” text, which are indicative of ngrok’s control channel communication.
5. Windows Defender Exclusion Audit
Verified PowerShell command to audit Windows Defender exclusions:
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Step-by-step guide:
Run this PowerShell command as Administrator to list all file path exclusions configured in Windows Defender. Winget-installed applications might reside in trusted paths that are excluded from scanning, creating blind spots. Regularly audit these exclusions to ensure they don’t create security gaps.
6. Hunting for ZIP Extraction Followed by Execution
Verified KQL query for detection engineering:
DeviceFileEvents
| where FileName endswith ".zip"
| where FolderPath contains "ngrok"
| join kind=inner (
DeviceProcessEvents
| where FileName in ("ngrok.exe", "ngrok")
) on DeviceId
| where Timestamp between (ago(10m) .. now())
Step-by-step guide:
This advanced hunting query correlates ZIP file extraction events containing “ngrok” in the path with subsequent execution of ngrok.exe within 10 minutes. This detects the exact scenario where manual ZIP extraction triggers alerts, helping security teams understand attack progression.
7. YARA Rule for ngrok Binary Identification
Verified YARA rule for ngrok detection:
rule Ngrok_Identifier
{
meta:
description = "Detects ngrok tunneling client"
author = "SecurityTeam"
date = "2024-01-01"
strings:
$s1 = "ngrok" ascii wide
$s2 = "tunnel" ascii wide
$s3 = "localhost:4040" ascii wide
condition:
all of them
}
Step-by-step guide:
Deploy this YARA rule in your endpoint detection or forensic tools to identify ngrok binaries across your environment. The rule looks for characteristic strings found in ngrok executables, enabling detection regardless of file name or location.
What Undercode Say:
- Source Reputation Cannot Replace Behavior Analysis: Security tools that prioritize installation source over actual tool capabilities create predictable bypass opportunities that attackers will inevitably exploit.
- Consistent Policy Enforcement is Non-Negotiable: The same tool should be treated identically regardless of deployment method; inconsistency indicates flawed detection logic.
The ngrok paradox exemplifies a broader industry challenge: the over-reliance on vendor reputation scoring at the expense of consistent behavioral analysis. While source-based trust mechanisms provide operational efficiency, they create security gaps that sophisticated attackers can weaponize. This incident should serve as a wake-up call for security teams to audit their detection consistency across different installation vectors and reinforce behavior-based detection capabilities. The fact that the same binary receives different treatment based solely on delivery mechanism reveals a fundamental weakness in how we define “trust” in modern security ecosystems.
Prediction:
Within 12-18 months, we will see a significant rise in malware campaigns that specifically leverage trusted software distribution channels like winget, Chocolatey, and official app stores to bypass traditional security controls. Threat actors will increasingly “weaponize trust” by packaging malicious tools within signed, reputation-approved installers, forcing a fundamental rearchitecture of how endpoint protection platforms evaluate threat potential beyond simple source reputation scoring.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Stephan Berger – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
