Windows Process Initiates Network Connection to portmap.io Domain

Alerts when a Windows process initiates a connection to a .portmap.io destination hostname.

FreeUnreviewedSigmamediumv1

windows-process-initiates-network-connection-to-portmap-io-domain-07837ab9

title: Windows Process Initiates Network Connection to portmap.io Domain
id: 19e2f55f-2b26-4edf-8241-ffffa04d72db
status: test
description: This rule flags network connections where a process initiates a connection to a destination hostname ending in .portmap.io. Such targeted outbound communication can indicate attempted command-and-control or data exfiltration activity. The detection relies on Windows network connection telemetry that includes an Initiated flag and the destination hostname.
references:
  - https://portmap.io/
  - https://github.com/rapid7/metasploit-framework/issues/11337
  - https://pro.twitter.com/JaromirHorejsi/status/1795001037746761892/photo/2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_portmap.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2024-05-31
tags:
  - attack.t1041
  - attack.command-and-control
  - attack.t1090.002
  - attack.exfiltration
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith: .portmap.io
  condition: selection
falsepositives:
  - Legitimate use of portmap.io domains
level: medium
license: DRL-1.1
related:
  - id: 07837ab9-60e1-481f-a74d-c31fb496a94c
    type: derived

What it detects

This rule flags network connections where a process initiates a connection to a destination hostname ending in .portmap.io. Such targeted outbound communication can indicate attempted command-and-control or data exfiltration activity. The detection relies on Windows network connection telemetry that includes an Initiated flag and the destination hostname.

Known false positives

Legitimate use of portmap.io domains

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.