Linux openssl s_client Connections to External IPs for SSL Certificate Exfiltration
Detects openssl s_client connecting to an IP:port on 443/8080 from Linux process command lines.
- Product
- linux
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-16
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Linux process executions of openssl that invoke s_client with -quiet and -connect to reach an external IP address, including common TLS ports 443 and 8080. Such behavior can indicate attempts to retrieve or exfiltrate SSL-related data or establish a stealthy outbound channel. It relies on process creation telemetry, matching the openssl binary path and specific command-line parameters within the executed command.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux openssl s_client Connections to External IPs for SSL Certificate Exfiltration
id: 81639e8f-e960-4098-ad10-9a6bb91fea4d
status: test
description: This rule identifies Linux process executions of openssl that invoke s_client with -quiet and -connect to reach an external IP address, including common TLS ports 443 and 8080. Such behavior can indicate attempts to retrieve or exfiltrate SSL-related data or establish a stealthy outbound channel. It relies on process creation telemetry, matching the openssl binary path and specific command-line parameters within the executed command.
references:
- https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_openssl_connection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
tags:
- attack.stealth
- attack.t1140
- detection.emerging-threats
logsource:
product: linux
category: process_creation
detection:
selection:
Image|endswith: /openssl
CommandLine|re: "[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
CommandLine|contains|all:
- s_client
- -quiet
- -connect
CommandLine|contains:
- :443
- :8080
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 60911c07-f989-4362-84af-c609828ef829
type: derived