Linux network connections to known malware callback ports

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1571Non-Standard Port
Exfiltration
Impact

What it detects

This rule flags Linux processes that initiate outbound network connections to specific destination ports associated with known malware callback activity. Attackers use callback ports to establish command-and-control channels and maintain persistent remote access. It relies on network connection telemetry capturing connection initiation status along with destination IP and destination port, excluding local/private address ranges to reduce noise.

Reporting behind it

Related detections7 linkedT1571 — drag to rearrange

Suspicious Outbound Connection To MoonPeak C2 High Ports

Possible Remcos C2 Connection from eilowutil Process

Malicious UNC4841 SSH Backdoor Persistence via Non-Standard Port and AllowUsers Restriction (via process_creation)

Malicious Reverse Shell via socat

Windows PowerShell Scripts Testing Uncommon Port Connectivity via Test-NetConnection

Windows Network Connections to Known Malware Callback Ports (Suspicious Destination Ports)

Windows Network Connections to Uncommon Ports (8080, 8888)

Linux network connections to known malware callback ports

Pivot detection · T1571 · 7 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-malware-callback-style-network-connections-to-known-suspicious-ports-dbfc7c98

title: Linux network connections to known malware callback ports
id: 531b40ab-0649-42d5-9f88-8286feee77a9
related:
  - id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382
    type: derived
  - id: dbfc7c98-04ab-4ab7-aa94-c74d22aa7376
    type: derived
status: test
description: This rule flags Linux processes that initiate outbound network connections to specific destination ports associated with known malware callback activity. Attackers use callback ports to establish command-and-control channels and maintain persistent remote access. It relies on network connection telemetry capturing connection initiation status along with destination IP and destination port, excluding local/private address ranges to reduce noise.
references:
  - https://www.mandiant.com/resources/blog/triton-actor-ttp-profile-custom-attack-tools-detections
  - https://www.mandiant.com/resources/blog/ukraine-and-sandworm-team
  - https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html
  - https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html
  - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_susp_malware_callback_port.yml
author: hasselj, Huntrule Team
date: 2024-05-10
tags:
  - attack.persistence
  - attack.command-and-control
  - attack.t1571
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Initiated: "true"
    DestinationPort:
      - 888
      - 999
      - 2200
      - 2222
      - 4000
      - 4444
      - 6789
      - 8531
      - 50501
      - 51820
  filter_main_local_ranges:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL