Linux network connections to known malware callback ports
Alerts on initiated Linux outbound connections to specific known suspicious destination ports, excluding local/private IP ranges.
- Product
- linux
- Category
- network_connection
- Author
- hasselj (SigmaHQ), DRL 1.1
- Published
- 2024-05-10
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Linux processes that initiate outbound network connections to specific destination ports associated with known malware callback activity. Attackers use callback ports to establish command-and-control channels and maintain persistent remote access. It relies on network connection telemetry capturing connection initiation status along with destination IP and destination port, excluding local/private address ranges to reduce noise.
Reporting behind it
- mandiant.comhttps://www.mandiant.com/resources/blog/triton-actor-ttp-profile-custom-attack-tools-detections
- mandiant.comhttps://www.mandiant.com/resources/blog/ukraine-and-sandworm-team
- elastic.cohttps://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html
- thehackernews.comhttps://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html
- cybereason.comhttps://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_susp_malware_callback_port.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux network connections to known malware callback ports
id: 531b40ab-0649-42d5-9f88-8286feee77a9
related:
- id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382
type: derived
- id: dbfc7c98-04ab-4ab7-aa94-c74d22aa7376
type: derived
status: test
description: This rule flags Linux processes that initiate outbound network connections to specific destination ports associated with known malware callback activity. Attackers use callback ports to establish command-and-control channels and maintain persistent remote access. It relies on network connection telemetry capturing connection initiation status along with destination IP and destination port, excluding local/private address ranges to reduce noise.
references:
- https://www.mandiant.com/resources/blog/triton-actor-ttp-profile-custom-attack-tools-detections
- https://www.mandiant.com/resources/blog/ukraine-and-sandworm-team
- https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html
- https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html
- https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_susp_malware_callback_port.yml
author: hasselj, Huntrule Team
date: 2024-05-10
tags:
- attack.persistence
- attack.command-and-control
- attack.t1571
logsource:
category: network_connection
product: linux
detection:
selection:
Initiated: "true"
DestinationPort:
- 888
- 999
- 2200
- 2222
- 4000
- 4444
- 6789
- 8531
- 50501
- 51820
filter_main_local_ranges:
DestinationIp|cidr:
- 127.0.0.0/8
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 169.254.0.0/16
- ::1/128
- fe80::/10
- fc00::/7
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1