Windows Executable Connects to portmap.io Domain Over Network

Alerts when a Windows process initiates a connection to a .portmap.io destination hostname.

FreeReviewedSigma · Medium · v2

Product: windows
Category: network_connection
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2024-05-31
Updated: 2026-07-31

ATT&CK techniques

C2 → Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1090.002External Proxy
Exfiltration
- T1041Exfiltration Over C2 Channel
Impact

What it detects

This rule identifies outbound network connections where a Windows process initiates communication to a destination hostname ending with .portmap.io. Such traffic may indicate command-and-control or data exfiltration attempts, especially when the destination domain is unexpected for the host. Detection relies on network connection telemetry containing the initiating process and the destination hostname.

Reporting behind it

Related detections9 linkedT1041 — drag to rearrange

Malicious AWS Credential Exfiltration via Curl or Wget in Process Creation

Malicious curl Exfiltration to Attacker Upload Endpoint on macOS (via process_creation)

Possible Proxyware SDK Beacon With Telemetry Parameters

Possible Residential Proxyware Beacon to PacketSDK Infrastructure

Suspicious Outlook Process Spawning Network Utilities for NotDoor C2 (via process_creation)

Possible FakeWallet Wallet Exfiltration via Structured POST Parameters (via proxy)

Malicious FakeWallet Crypto Stealer C2 via Rsakey Endpoints (via proxy)

Possible Malicious MCP Server Credential Exfiltration via DevTools-Assistant Agent (via proxy)

Suspicious curl POST Exfiltration of Archive from tmp Staging Folder via process_creation

Windows Executable Connects to portmap.io Domain Over Network

Pivot detection · T1041 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-initiates-network-connection-to-portmap-io-domain-07837ab9

title: Windows Executable Connects to portmap.io Domain Over Network
id: 19e2f55f-2b26-4edf-8241-ffffa04d72db
status: test
description: This rule identifies outbound network connections where a Windows process initiates communication to a destination hostname ending with .portmap.io. Such traffic may indicate command-and-control or data exfiltration attempts, especially when the destination domain is unexpected for the host. Detection relies on network connection telemetry containing the initiating process and the destination hostname.
references:
  - https://portmap.io/
  - https://github.com/rapid7/metasploit-framework/issues/11337
  - https://pro.twitter.com/JaromirHorejsi/status/1795001037746761892/photo/2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_portmap.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2024-05-31
tags:
  - attack.t1041
  - attack.command-and-control
  - attack.t1090.002
  - attack.exfiltration
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith: .portmap.io
  condition: selection
falsepositives:
  - Legitimate use of portmap.io domains
level: medium
license: DRL-1.1
related:
  - id: 07837ab9-60e1-481f-a74d-c31fb496a94c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL