deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Local Network Connection Initiated By Script Interpreter
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-08-28
ATT&CK techniques: T1105
Log source: windows/network_connection

Description:
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "Image|endswith": [
      "\\wscript.exe",
      "\\cscript.exe"
    ],
    "DestinationIp|cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/28d190330fe44de6ff4767fc400cc10fa7cd6540/atomics/T1105/T1105.md
Sigma Detection Rule: Potentially Suspicious Wuauclt Network Connection
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-10-12
ATT&CK techniques: T1218
Log source: windows/network_connection

Description:
Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections.
One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.


Detection logic:
{
  "selection": {
    "Image|contains": "wuauclt",
    "CommandLine|contains": " /RunHandlerComServer"
  },
  "filter_main_ip": {
    "DestinationIp|cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "169.254.0.0/16",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "filter_main_msrange": {
    "DestinationIp|cidr": [
      "20.184.0.0/13",
      "20.192.0.0/10",
      "23.79.0.0/16",
      "51.10.0.0/15",
      "51.103.0.0/16",
      "51.104.0.0/15",
      "52.224.0.0/11"
    ]
  },
  "filter_main_uus": {
    "CommandLine|contains": [
      ":\\Windows\\UUS\\Packages\\Preview\\amd64\\updatedeploy.dll /ClassId",
      ":\\Windows\\UUS\\amd64\\UpdateDeploy.dll /ClassId"
    ]
  },
  "filter_main_winsxs": {
    "CommandLine|contains|all": [
      ":\\Windows\\WinSxS\\",
      "\\UpdateDeploy.dll /ClassId "
    ]
  },
  "filter_main_cli_null": {
    "CommandLine": null
  },
  "filter_main_cli_empty": {
    "CommandLine": ""
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://dtm.uk/wuauclt/
Sigma Detection Rule: Network Connection Initiated To BTunnels Domains
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Kamran Saifullah
Date: 2024-09-13
ATT&CK techniques: T1567, T1572
Log source: windows/network_connection

Description:
Detects network connections to BTunnels domains initiated by a process on the system.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "DestinationHostname|endswith": ".btunnel.co.in"
  },
  "condition": "selection"
}

References:
  - https://defr0ggy.github.io/research/Utilizing-BTunnel-For-Data-Exfiltration/
Sigma Detection Rule: RDP to HTTP or HTTPS Target Ports
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-04-29
ATT&CK techniques: T1572, T1021.001
Log source: windows/network_connection

Description:
Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443

Detection logic:
{
  "selection": {
    "Image|endswith": "\\svchost.exe",
    "Initiated": "true",
    "SourcePort": 3389,
    "DestinationPort": [
      80,
      443
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/tekdefense/status/[PII_REDACTED]62556416?s=12&t=OTsHCBkQOTNs1k3USz65Zg
  - https://www.mandiant.com/resources/bypassing-network-restrictions-through-rdp-tunneling
Sigma Detection Rule: Communication To LocaltoNet Tunneling Service Initiated
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Andreas Braathen (mnemonic.io)
Date: 2024-06-17
ATT&CK techniques: T1572, T1090, T1102
Log source: windows/network_connection

Description:
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.


Detection logic:
{
  "selection": {
    "DestinationHostname|endswith": [
      ".localto.net",
      ".localtonet.com"
    ],
    "Initiated": "true"
  },
  "condition": "selection"
}

References:
  - https://localtonet.com/documents/supported-tunnels
  - https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications
Sigma Detection Rule: Network Connection Initiated To Visual Studio Code Tunnels Domain
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Kamran Saifullah
Date: 2023-11-20
ATT&CK techniques: T1567, T1572
Log source: windows/network_connection

Description:
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "DestinationHostname|endswith": ".tunnels.api.visualstudio.com"
  },
  "condition": "selection"
}

References:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
  - https://cydefops.com/vscode-data-exfiltration
Sigma Detection Rule: Potentially Suspicious Malware Callback Communication
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-19
ATT&CK techniques: T1571
Log source: windows/network_connection

Description:
Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "DestinationPort": [
      100,
      198,
      200,
      243,
      473,
      666,
      700,
      743,
      777,
      1443,
      1515,
      1777,
      1817,
      1904,
      1960,
      2443,
      2448,
      3360,
      3675,
      3939,
      4040,
      4433,
      4438,
      4443,
      4444,
      4455,
      5445,
      5552,
      5649,
      6625,
      7210,
      7777,
      8143,
      8843,
      9631,
      9943,
      10101,
      12102,
      12103,
      12322,
      13145,
      13394,
      13504,
      13505,
      13506,
      13507,
      14102,
      14103,
      14154,
      49180,
      65520,
      65535
    ]
  },
  "filter_main_local_ranges": {
    "DestinationIp|cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "filter_optional_sys_directories": {
    "Image|startswith": [
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
Sigma Detection Rule: Uncommon Connection to Active Directory Web Services
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @kostastsale
Date: 2024-01-26
ATT&CK techniques: T1087
Log source: windows/network_connection

Description:
Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.


Detection logic:
{
  "selection": {
    "Initiated": true,
    "DestinationPort": 9389
  },
  "filter_main_dsac": {
    "Image": "C:\\Windows\\system32\\dsac.exe"
  },
  "filter_main_ms_monitoring_agent": {
    "Image": "C:\\Program Files\\Microsoft Monitoring Agent\\"
  },
  "filter_main_powershell": {
    "Image|startswith": [
      "C:\\Program Files\\PowerShell\\7\\pwsh.exe",
      "C:\\Program Files\\PowerShell\\7-preview\\pwsh.ex",
      "C:\\Windows\\System32\\WindowsPowerShell\\",
      "C:\\Windows\\SysWOW64\\WindowsPowerShell\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c
  - https://github.com/FalconForceTeam/FalconFriday/blob/a9219dfcfd89836f34660223f47d766982bdce46/Discovery/ADWS_Connection_from_Unexpected_Binary-Win.md
Sigma Detection Rule: Suspicious Wordpad Outbound Connections
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-07-12
Log source: windows/network_connection

Description:
Detects a network connection initiated by "wordpad.exe" over uncommon destination ports.
This might indicate potential process injection activity from a beacon or similar mechanisms.


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "Image|endswith": "\\wordpad.exe"
  },
  "filter_main_ports": {
    "DestinationPort": [
      80,
      139,
      443,
      445,
      465,
      587,
      993,
      995
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
Sigma Detection Rule: Network Connection Initiated By Regsvr32.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Dmitriy Lifanov, oscd.community
Date: 2019-10-25
ATT&CK techniques: T1559.001, T1218.010
Log source: windows/network_connection

Description:
Detects a network connection initiated by "Regsvr32.exe"

Detection logic:
{
  "selection": {
    "Initiated": "true",
    "Image|endswith": "\\regsvr32.exe"
  },
  "condition": "selection"
}

References:
  - https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/
  - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
Sigma Detection Rule: Suspicious Network Connection to IP Lookup Service APIs
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-24
ATT&CK techniques: T1016
Log source: windows/network_connection

Description:
Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicative of potential post compromise internet test activity.

Detection logic:
{
  "selection": [
    {
      "DestinationHostname": [
        "www.ip.cn",
        "l2.io"
      ]
    },
    {
      "DestinationHostname|contains": [
        "api.2ip.ua",
        "api.bigdatacloud.net",
        "api.ipify.org",
        "bot.whatismyipaddress.com",
        "canireachthe.net",
        "checkip.amazonaws.com",
        "checkip.dyndns.org",
        "curlmyip.com",
        "db-ip.com",
        "edns.ip-api.com",
        "eth0.me",
        "freegeoip.app",
        "geoipy.com",
        "getip.pro",
        "icanhazip.com",
        "ident.me",
        "ifconfig.io",
        "ifconfig.me",
        "ip-api.com",
        "ip.360.cn",
        "ip.anysrc.net",
        "ip.taobao.com",
        "ip.tyk.nu",
        "ipaddressworld.com",
        "ipapi.co",
        "ipconfig.io",
        "ipecho.net",
        "ipinfo.io",
        "ipip.net",
        "ipof.in",
        "ipv4.icanhazip.com",
        "ipv4bot.whatismyipaddress.com",
        "ipv6-test.com",
        "ipwho.is",
        "jsonip.com",
        "myexternalip.com",
        "seeip.org",
        "wgetip.com",
        "whatismyip.akamai.com",
        "whois.pconline.com.cn",
        "wtfismyip.com"
      ]
    }
  ],
  "filter_optional_brave": {
    "Image|endswith": "\\brave.exe"
  },
  "filter_optional_chrome": {
    "Image": [
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
      "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe"
    ]
  },
  "filter_optional_firefox": {
    

References:
  - https://github.com/rsp/scripts/blob/c8bb272d68164a9836e4f273d8f924927f39b8c6/externalip-benchmark.md
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a
  - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
  - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html
Sigma Detection Rule: Rundll32 Internet Connection
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-11-04
ATT&CK techniques: T1218.011
Log source: windows/network_connection

Description:
Detects a rundll32 that communicates with public IP addresses

Detection logic:
{
  "selection": {
    "Image|endswith": "\\rundll32.exe",
    "Initiated": "true"
  },
  "filter_main_local_ranges": {
    "DestinationIp|cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "filter_main_ms_ranges": {
    "DestinationIp|cidr": [
      "20.0.0.0/8",
      "51.103.0.0/16",
      "51.104.0.0/16",
      "51.105.0.0/16"
    ]
  },
  "filter_main_app_sdb": {
    "CommandLine|endswith": "\\system32\\PcaSvc.dll,PcaPatchSdbTask"
  },
  "filter_main_azure_managed": {
    "SourceHostname|endswith": ".internal.cloudapp.net"
  },
  "filter_main_svchost_update_processes": {
    "ParentImage": "C:\\Windows\\System32\\svchost.exe",
    "DestinationPort": 443
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.hybrid-analysis.com/sample/759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6?environmentId=100
Sigma Detection Rule: Suspicious Dropbox API Usage
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-04-20
ATT&CK techniques: T1105, T1567.002
Log source: windows/network_connection

Description:
Detects an executable that isn't dropbox but communicates with the Dropbox API

Detection logic:
{
  "selection": {
    "Initiated": "true",
    "DestinationHostname|endswith": [
      "api.dropboxapi.com",
      "content.dropboxapi.com"
    ]
  },
  "filter_main_legit_dropbox": {
    "Image|contains": "\\Dropbox"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://app.any.run/tasks/7e906adc-9d11-447f-8641-5f40375ecebb
  - https://www.zscaler.com/blogs/security-research/new-espionage-attack-molerats-apt-targeting-users-middle-east
Sigma Detection Rule: Outbound Network Connection Initiated By Script Interpreter
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Florian Roth (Nextron Systems)
Date: 2022-08-28
ATT&CK techniques: T1105
Log source: windows/network_connection

Description:
Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.

Detection logic:
{
  "selection": {
    "Initiated": "true",
    "Image|endswith": [
      "\\wscript.exe",
      "\\cscript.exe"
    ]
  },
  "filter_main_local_ranges": {
    "DestinationIp|cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "filter_main_ms_ranges": {
    "DestinationIp|cidr": "20.0.0.0/11"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/28d190330fe44de6ff4767fc400cc10fa7cd6540/atomics/T1105/T1105.md
Sigma Detection Rule: Microsoft Sync Center Suspicious Network Connections
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: elhoim
Date: 2022-04-28
ATT&CK techniques: T1055, T1218
Log source: windows/network_connection

Description:
Detects suspicious connections from Microsoft Sync Center to non-private IPs.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\mobsync.exe"
  },
  "filter_main_local_ranges": {
    "DestinationIp|cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://redcanary.com/blog/intelligence-insights-november-2021/
Sigma Detection Rule: Outbound Network Connection Initiated By Microsoft Dialer
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: CertainlyP
Date: 2024-04-26
ATT&CK techniques: T1071.001
Log source: windows/network_connection

Description:
Detects outbound network connection initiated by Microsoft Dialer.
The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer.
This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"


Detection logic:
{
  "selection": {
    "Image|endswith": ":\\Windows\\System32\\dialer.exe",
    "Initiated": "true"
  },
  "filter_main_local_ranges": {
    "DestinationIp|cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://tria.ge/240301-rk34sagf5x/behavioral2
  - https://app.any.run/tasks/6720b85b-9c53-4a12-b1dc-73052a78477d
  - https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/
  - https://strontic.github.io/xcyclopedia/library/dialer.exe-0B69655F912619756C704A0BF716B61F.html
Sigma Detection Rule: Suspicious Network Connection Binary No CommandLine
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-07-03
Log source: windows/network_connection

Description:
Detects suspicious network connections made by a well-known Windows binary run with no command line parameters

Detection logic:
{
  "selection": {
    "Initiated": "true",
    "Image|endswith": [
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\dllhost.exe"
    ],
    "CommandLine|endswith": [
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\dllhost.exe"
    ]
  },
  "filter_no_cmdline": {
    "CommandLine": ""
  },
  "filter_null": {
    "CommandLine": null
  },
  "condition": "selection and not 1 of filter*"
}

References:
  - https://redcanary.com/blog/raspberry-robin/
Sigma Detection Rule: Suspicious Non-Browser Network Communication With Telegram API
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-19
ATT&CK techniques: T1102, T1567, T1105
Log source: windows/network_connection

Description:
Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2

Detection logic:
{
  "selection": {
    "DestinationHostname|contains": "api.telegram.org"
  },
  "filter_main_brave": {
    "Image|endswith": "\\brave.exe"
  },
  "filter_main_chrome": {
    "Image": [
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
      "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe"
    ]
  },
  "filter_main_firefox": {
    "Image": [
      "C:\\Program Files\\Mozilla Firefox\\firefox.exe",
      "C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe"
    ]
  },
  "filter_main_ie": {
    "Image": [
      "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "C:\\Program Files\\Internet Explorer\\iexplore.exe"
    ]
  },
  "filter_main_maxthon": {
    "Image|endswith": "\\maxthon.exe"
  },
  "filter_main_edge_1": [
    {
      "Image|startswith": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\"
    },
    {
      "Image|endswith": "\\WindowsApps\\MicrosoftEdge.exe"
    },
    {
      "Image": [
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
        "C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe"
      ]
    }
  ],
  "filter_main_edge_2": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\Microsoft\\EdgeCore\\",
      "C:\\Program Files\\Microsoft\\EdgeCore\\"
    ],
    "Image|endswith": [
      "\\msedge.exe",
      "\\msedgewebview2.exe"
    ]
  },
  "filter_main_opera": {
    "Image|endswith": "\\opera.exe"
  },
  "filter_main_safari": {
    "Image|end

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf
Sigma Detection Rule: Office Application Initiated Network Connection Over Uncommon Ports
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-12
Log source: windows/network_connection

Description:
Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports.

Detection logic:
{
  "selection": {
    "Initiated": "true",
    "Image|endswith": [
      "\\excel.exe",
      "\\outlook.exe",
      "\\powerpnt.exe",
      "\\winword.exe",
      "\\wordview.exe"
    ]
  },
  "filter_main_common_ports": {
    "DestinationPort": [
      53,
      80,
      139,
      389,
      443,
      445,
      3268
    ]
  },
  "filter_main_outlook_ports": {
    "Image|contains": ":\\Program Files\\Microsoft Office\\",
    "Image|endswith": "\\OUTLOOK.EXE",
    "DestinationPort": [
      143,
      465,
      587,
      993,
      995
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
Sigma Detection Rule: Communication To Uncommon Destination Ports
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-19
ATT&CK techniques: T1571
Log source: windows/network_connection

Description:
Detects programs that connect to uncommon destination ports

Detection logic:
{
  "selection": {
    "Initiated": "true",
    "DestinationPort": [
      8080,
      8888
    ]
  },
  "filter_main_local_ranges": {
    "DestinationIp|cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "filter_optional_sys_directories": {
    "Image|startswith": [
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
Sigma Detection Rule: Uncommon Network Connection Initiated By Certutil.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Florian Roth (Nextron Systems)
Date: 2022-09-02
ATT&CK techniques: T1105
Log source: windows/network_connection

Description:
Detects a network connection initiated by the certutil.exe utility.
Attackers can abuse the utility in order to download malware or additional payloads.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\certutil.exe",
    "Initiated": "true",
    "DestinationPort": [
      80,
      135,
      443,
      445
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil