Windows Process Initiated Connections to .btunnel.co.in Domains
Flags initiated outbound connections to .btunnel.co.in domains from a Windows host.
- Product
- windows
- Category
- network_connection
- Author
- Kamran Saifullah (SigmaHQ), DRL 1.1
- Published
- 2024-09-13
- Updated
- 2026-07-31
ATT&CK techniques
C2 → ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies network connections initiated by a local process to destinations ending with .btunnel.co.in on Windows. Such outbound tunneling domains can be abused to support command-and-control behaviors like remote access, reverse shells, or persistence. The detection relies on network connection telemetry that includes whether the connection was initiated and the destination hostname.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Initiated Connections to .btunnel.co.in Domains
id: bd3cce49-8d2f-4d68-8ee2-0146aa38ee82
status: test
description: This rule identifies network connections initiated by a local process to destinations ending with .btunnel.co.in on Windows. Such outbound tunneling domains can be abused to support command-and-control behaviors like remote access, reverse shells, or persistence. The detection relies on network connection telemetry that includes whether the connection was initiated and the destination hostname.
references:
- https://defr0ggy.github.io/research/Utilizing-BTunnel-For-Data-Exfiltration/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_btunnels.yml
author: Kamran Saifullah, Huntrule Team
date: 2024-09-13
tags:
- attack.exfiltration
- attack.command-and-control
- attack.t1567
- attack.t1572
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: "true"
DestinationHostname|endswith: .btunnel.co.in
condition: selection
falsepositives:
- Legitimate use of BTunnels will also trigger this.
level: medium
license: DRL-1.1
related:
- id: 9e02c8ec-02b9-43e8-81eb-34a475ba7965
type: derived