Windows Network Connections to BTunnel Domains

Flags initiated outbound connections to .btunnel.co.in domains from a Windows host.

FreeUnreviewedSigmamediumv1

windows-network-connections-to-btunnel-domains-9e02c8ec

title: Windows Network Connections to BTunnel Domains
id: bd3cce49-8d2f-4d68-8ee2-0146aa38ee82
status: test
description: This rule identifies outbound network connections that are initiated by a local process to destination hostnames ending with .btunnel.co.in. Attackers may use BTunnel domains to route traffic for command-and-control or to establish remote access and persistence. The detection relies on Windows network connection telemetry that includes whether the connection was initiated and the destination hostname.
references:
  - https://defr0ggy.github.io/research/Utilizing-BTunnel-For-Data-Exfiltration/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_btunnels.yml
author: Kamran Saifullah, Huntrule Team
date: 2024-09-13
tags:
  - attack.exfiltration
  - attack.command-and-control
  - attack.t1567
  - attack.t1572
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith: .btunnel.co.in
  condition: selection
falsepositives:
  - Legitimate use of BTunnels will also trigger this.
level: medium
license: DRL-1.1
related:
  - id: 9e02c8ec-02b9-43e8-81eb-34a475ba7965
    type: derived

What it detects

This rule identifies outbound network connections that are initiated by a local process to destination hostnames ending with .btunnel.co.in. Attackers may use BTunnel domains to route traffic for command-and-control or to establish remote access and persistence. The detection relies on Windows network connection telemetry that includes whether the connection was initiated and the destination hostname.

Known false positives

Legitimate use of BTunnels will also trigger this.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.