Windows Network Connections to Uncommon Ports (8080, 8888)

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1571Non-Standard Port
Exfiltration
Impact

What it detects

This rule flags Windows processes that initiate network connections to destination ports 8080 or 8888 when the destination is not within common local/private and reserved IP ranges and the process image is not under standard Program Files directories. Uncommon service port communication can indicate command-and-control or persistence attempts, especially when directed to non-local targets. The detection relies on network connection telemetry with fields for whether the connection was initiated, destination IP, destination port, and the process image path.

Reporting behind it

Related detections7 linkedT1571 — drag to rearrange

Suspicious Outbound Connection To MoonPeak C2 High Ports

Possible Remcos C2 Connection from eilowutil Process

Malicious UNC4841 SSH Backdoor Persistence via Non-Standard Port and AllowUsers Restriction (via process_creation)

Malicious Reverse Shell via socat

Linux network connections to known malware callback ports

Windows PowerShell Scripts Testing Uncommon Port Connectivity via Test-NetConnection

Windows Network Connections to Known Malware Callback Ports (Suspicious Destination Ports)

Windows Network Connections to Uncommon Ports (8080, 8888)

Pivot detection · T1571 · 7 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-network-connections-to-uncommon-destination-ports-8080-8888-6d8c3d20

title: Windows Network Connections to Uncommon Ports (8080, 8888)
id: c0585dab-1d7f-422b-9da0-3137a45fd5c4
related:
  - id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382
    type: similar
  - id: 6d8c3d20-a5e1-494f-8412-4571d716cf5c
    type: derived
status: test
description: This rule flags Windows processes that initiate network connections to destination ports 8080 or 8888 when the destination is not within common local/private and reserved IP ranges and the process image is not under standard Program Files directories. Uncommon service port communication can indicate command-and-control or persistence attempts, especially when directed to non-local targets. The detection relies on network connection telemetry with fields for whether the connection was initiated, destination IP, destination port, and the process image path.
references:
  - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_malware_callback_ports_uncommon.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-19
modified: 2024-03-12
tags:
  - attack.persistence
  - attack.command-and-control
  - attack.t1571
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationPort:
      - 8080
      - 8888
  filter_main_local_ranges:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  filter_optional_sys_directories:
    Image|startswith:
      - C:\Program Files\
      - C:\Program Files (x86)\
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL