Suspicious Use of Remote Tunneling Services by Common Execution Tools
Detects network connections to known remote tunneling and relay services (e.g., ngrok, Cloudflare Tunnel) initiated by commonly abused LOLBins or processes running from user-writable directories. This behavior is often indicative of an adversary establishing persistent remote access or egress channels for command-and-control communication.
Microsoft Sentinel (KQL)
