Linux malware callback-style network connections to known suspicious ports

Alerts on initiated Linux outbound connections to specific known suspicious destination ports, excluding local/private IP ranges.

FreeUnreviewedSigmahighv1

linux-malware-callback-style-network-connections-to-known-suspicious-ports-dbfc7c98

title: Linux malware callback-style network connections to known suspicious ports
id: 531b40ab-0649-42d5-9f88-8286feee77a9
related:
  - id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382
    type: derived
  - id: dbfc7c98-04ab-4ab7-aa94-c74d22aa7376
    type: derived
status: test
description: This rule flags Linux network connections that are initiated and target a set of known callback-related destination ports. Such connections can indicate malware attempting command-and-control reachability or persistence through outbound traffic. It relies on network_connection telemetry that includes connection initiation status, destination IP, and destination port, and it filters out local and private address ranges to reduce noise.
references:
  - https://www.mandiant.com/resources/blog/triton-actor-ttp-profile-custom-attack-tools-detections
  - https://www.mandiant.com/resources/blog/ukraine-and-sandworm-team
  - https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html
  - https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html
  - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_susp_malware_callback_port.yml
author: hasselj, Huntrule Team
date: 2024-05-10
tags:
  - attack.persistence
  - attack.command-and-control
  - attack.t1571
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Initiated: "true"
    DestinationPort:
      - 888
      - 999
      - 2200
      - 2222
      - 4000
      - 4444
      - 6789
      - 8531
      - 50501
      - 51820
  filter_main_local_ranges:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Linux network connections that are initiated and target a set of known callback-related destination ports. Such connections can indicate malware attempting command-and-control reachability or persistence through outbound traffic. It relies on network_connection telemetry that includes connection initiation status, destination IP, and destination port, and it filters out local and private address ranges to reduce noise.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.