Duplicate *http* Pattern in Windows Ngrok Reverse Proxy Usage Detection

Hi,

This is a relatively small problem and I understand that it doesn’t really affect the Windows Ngrok Reverse Proxy Usage Detection process at all. It still works perfectly fine the way it is.

But upon going through the detection process, I found that the http is being repeated twice in the Processes.process IN clause:

Processes.process IN ("*start*", "*--config*", "*http*", "*authtoken*", "*http*", "*tcp*")

It seems that the second occurrence of http is a repeat and can therefore be deleted to improve the search.

Processes.process IN ("*start*", "*--config*", "*http*", "*authtoken*", "*tcp*")

Of course, this is just a tiny problem and it doesn’t impact the way the detection works and the results it produces in any significant way.
The reason I bring up these inconsistencies is just that I like participating in the Security Content project in whatever small way I can participate. It’s always useful for keeping search results more optimal, consistent, and neat, and I would rather report a tiny problem than ignore it when I see one.

It’s a fantastic project, and I hope my contributions can add to its already high value.

Thank you for your time and consideration.

Best regards

App Version:
ESCU: [6.6.0]

Start by locating the Windows Ngrok Reverse Proxy Usage Detection entry and inspect its Processes.process IN clause. Remove the repeated "http" value, then verify that the resulting detection definition remains valid and contains the intended patterns.