huntrule

Windows Network Connections to Known Malware Callback Ports (Suspicious Destination Ports)

Flags Windows processes initiating outbound connections to malware callback ports, excluding local/private IP ranges.

FreeReviewedSigma · High · v2
Product
windows
Category
network_connection
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2017-03-19
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows processes that initiate network connections to a list of destination ports commonly associated with malware callback traffic. Such activity can indicate command-and-control behavior where malware establishes outbound connectivity to external infrastructure. It relies on network connection telemetry capturing whether the connection was initiated and the destination IP and port, with exclusions for local and private ranges and common program directories.

Reporting behind it

Related detections7 linkedT1571 — drag to rearrange
Suspicious Outbound Connection To MoonPeak C2 High Ports
Possible Remcos C2 Connection from eilowutil Process
Malicious UNC4841 SSH Backdoor Persistence via Non-Standard Port and AllowUsers Restriction (via process_creation)
Malicious Reverse Shell via socat
Linux network connections to known malware callback ports
Windows PowerShell Scripts Testing Uncommon Port Connectivity via Test-NetConnection
Windows Network Connections to Uncommon Ports (8080, 8888)
Windows Network Connections to Known Malware Callback Ports (Suspicious Destination Ports)
Pivot detection · T1571 · 7 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.