Linux Openssl s_client Connection to IP:Port for SSL Certificate Exfiltration

title: Linux Openssl s_client Connection to IP:Port for SSL Certificate Exfiltration
id: 81639e8f-e960-4098-ad10-9a6bb91fea4d
status: test
description: This rule flags Linux process executions of openssl that use s_client with -quiet and -connect to an explicit IP address and common ports (443 or 8080). Attackers can leverage openssl to fetch or relay TLS/SSL-related data and potentially exfiltrate certificate material or use the connection as a covert communication path. It relies on process creation telemetry capturing the executed binary path and the full command line parameters.
references:
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_openssl_connection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
tags:
  - attack.stealth
  - attack.t1140
  - detection.emerging-threats
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /openssl
    CommandLine|re: "[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
    CommandLine|contains|all:
      - s_client
      - -quiet
      - -connect
    CommandLine|contains:
      - :443
      - :8080
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 60911c07-f989-4362-84af-c609828ef829
    type: derived