huntrule

Linux openssl s_client Connections to External IPs for SSL Certificate Exfiltration

Detects openssl s_client connecting to an IP:port on 443/8080 from Linux process command lines.

FreeReviewedSigma · High · v5
Product
linux
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-06-16
Updated
2026-07-31
AnalysisDetection
title: Linux openssl s_client Connections to External IPs for SSL Certificate Exfiltration
id: 81639e8f-e960-4098-ad10-9a6bb91fea4d
status: test
description: This rule identifies Linux process executions of openssl that invoke s_client with -quiet and -connect to reach an external IP address, including common TLS ports 443 and 8080. Such behavior can indicate attempts to retrieve or exfiltrate SSL-related data or establish a stealthy outbound channel. It relies on process creation telemetry, matching the openssl binary path and specific command-line parameters within the executed command.
references:
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_openssl_connection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
tags:
  - attack.stealth
  - attack.t1140
  - detection.emerging-threats
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /openssl
    CommandLine|re: "[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
    CommandLine|contains|all:
      - s_client
      - -quiet
      - -connect
    CommandLine|contains:
      - :443
      - :8080
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 60911c07-f989-4362-84af-c609828ef829
    type: derived