Query: write Sigma for Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over
Matching passage: Sigma rule: Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over. Logsource: windows / ps_script. Rule: title: Testing Usage of Uncommonly Used Port id: adf876b3-f1f8-4aa9-a4e4-a64106feec06 status: test description: 'Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1571/T1571.md#atomic-test-1---testing-usage-of-uncommonly-used-port-with-powershell - https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps author: frack113 date: 2022-01-23 tags: - attack.command-and-control - attack.t1571 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Test-NetConnection - '-ComputerName ' - '-port ' filter: ScriptBlockText|contains: - ' 443 ' - ' 80 ' condition: selection and not filter falsepositives: - Legitimate administrative script level: medium
Near-miss passage: Sigma rule: Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation. Logsource: windows / process_creation. Rule: title: Suspicious ClickFix/FileFix Execution Pattern id: d487ed4a-fd24-436d-a0b2-f4e95f7b2635 related: - id: f5fe36cf-f1ec-4c23-903d-09a3110f6bbb type: similar status: experimental description: 'Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix). Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems. ' references: - https://github.com/JohnHammond/recaptcha-phish - https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware - https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/ - https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2 - https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution - https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/ author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-19 tags: - attack.execution - attack.t1204.001 - attack.t1204.004 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \explorer.exe CommandLine|contains: '#' selection_cli_captcha: CommandLine|contains: - account - anti-bot - botcheck - captcha - challenge - confirmation - fraud - human - identification - identificator - identity - robot - validation - verification - verify condition: all of selection_* falsepositives: - Unlikely level: high