Query: write Sigma for Detects an executable, which is not an internet browser or known application, initiating network connections to legit po
Matching passage: Sigma rule: Detects an executable, which is not an internet browser or known application, initiating network connections to legit po. Logsource: windows / network_connection. Rule: title: New Connection Initiated To Potential Dead Drop Resolver Domain id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7 related: - id: d7b09985-95a3-44be-8450-b6eadf49833e type: obsolete - id: 8b48ad89-10d8-4382-a546-50588c410f0d type: similar - id: d635249d-86b5-4dad-a8c7-d7272b788586 type: similar - id: 52182dfb-afb7-41db-b4bc-5336cb29b464 type: similar - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99 type: similar - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97 type: similar - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f type: similar - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c type: similar - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794 type: similar - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb type: similar - id: b6e04788-29e1-4557-bb14-77f761848ab8 type: similar - id: a0d7e4d2-bede-4141-8896-bc6e237e977c type: similar status: test description: 'Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks. In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected. ' references: - https://web.archive.org/web/20220830134315/https://content.fireeye.com/apt-41/rpt-apt41/ - https://securelist.com/the-tetrade-brazilian-banking-malware/97779/ - https://blog.bushidotoken.net/2021/04/dead-drop-resolvers-espionage-inspired.html - https://github.com/kleiton0x00/RedditC2 - https://twitter.com/kleiton0x7e/status/1600567316810551296 - https://www.linkedin.com/posts/kleiton-kurti_github-kleiton0x00redditc2-abusing-reddit-activity-7009939662462984192-5DbI/?originalSubdomain=al author: Sorina Ionescu, X__Junior (Nextron Systems) date: 2022-08-17 modified: 2026-03-29 tags: - attack.command-and-control - attack.t1102 - attack.t1102.001 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: - .t.me - 0x0.st - 4shared.com - abuse.ch - anonfiles.com - bashupload.com - cdn.discordapp.com - chunk.io - cloudflare.com - ddns.net - discord.com - docs.google.com - drive.google.com - dropbox.com - dropmefiles.com - facebook.com - feeds.rapidfeeds.com - fotolog.com - ghostbin.co/ - githubusercontent.com - gofile.io - hastebin.com - imgur.com - livejournal.com - mediafire.com - mega.co.nz - mega.nz - onedrive.com - pages.dev - paste.ee - pastebin.com - pastebin.pl - pastetext.net - pixeldrain.com - privatlab.com - privatlab.net - reddi
Near-miss passage: Sigma rule: Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to b. Logsource: linux / auditd. Rule: title: Modify System Firewall id: 323ff3f5-0013-4847-bbd4-250b5edb62cc related: - id: 53059bc0-1472-438b-956a-7508a94a91f0 type: similar status: test description: 'Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access. Detection rules that match only on the disabling of firewalls will miss this. ' references: - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html - https://blog.aquasec.com/container-security-tnt-container-attack - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking author: IAI date: 2023-03-06 modified: 2025-10-12 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux service: auditd detection: selection1: type: EXECVE a0: iptables a1|contains: DROP selection2: type: EXECVE a0: firewall-cmd a1|contains: remove selection3: type: EXECVE a0: ufw a1|contains: delete selection4: type: EXECVE a0: nft a1|contains: - delete - flush condition: 1 of selection* falsepositives: - Legitimate admin activity level: medium