Windows network connections to uncommon destination ports (8080, 8888)

title: Windows network connections to uncommon destination ports (8080, 8888)
id: c0585dab-1d7f-422b-9da0-3137a45fd5c4
related:
  - id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382
    type: similar
  - id: 6d8c3d20-a5e1-494f-8412-4571d716cf5c
    type: derived
status: test
description: This rule identifies Windows processes that initiate outbound network connections to destination ports 8080 or 8888 while excluding connections to common local/private IP ranges and excluding binaries running from standard Program Files directories. Uncommon service ports are often used for application communication, including command-and-control style traffic, and can indicate unexpected network behavior. It relies on Windows network connection telemetry with fields for connection initiation status, destination port, destination IP, and the initiating process image path.
references:
  - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_malware_callback_ports_uncommon.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-19
modified: 2024-03-12
tags:
  - attack.persistence
  - attack.command-and-control
  - attack.t1571
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationPort:
      - 8080
      - 8888
  filter_main_local_ranges:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  filter_optional_sys_directories:
    Image|startswith:
      - C:\Program Files\
      - C:\Program Files (x86)\
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1