Windows Executable Connects to portmap.io Domain Over Network

Alerts when a Windows process initiates a connection to a .portmap.io destination hostname.

FreeReviewedSigma · Medium · v2

Product: windows
Category: network_connection
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2024-05-31
Updated: 2026-07-31

ATT&CK techniques

C2 → Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1090.002External Proxy
Exfiltration
- T1041Exfiltration Over C2 Channel
Impact

What it detects

This rule identifies outbound network connections where a Windows process initiates communication to a destination hostname ending with .portmap.io. Such traffic may indicate command-and-control or data exfiltration attempts, especially when the destination domain is unexpected for the host. Detection relies on network connection telemetry containing the initiating process and the destination hostname.

Reporting behind it

Related detections9 linkedT1041 — drag to rearrange

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious Vice Society Directory Crawling Script for Data Exfiltration - Via Ps_script (via ps_script)

Malicious PowerShell Exfiltration to webhook.site Following WSUS Exploitation

Suspicious InvisibleFerret C2 Endpoints over Port 1224 (via proxy)

Suspicious CurKeep Backdoor C2 API Endpoints (via proxy)

Suspicious DEEPPOST Data Exfiltration URI Pattern via BrazenBamboo

Suspicious Error 524 Decoy Smishing Phishing Endpoint Access (via proxy)

Suspicious COOKIE SPIDER macOS Data Exfiltration via curl Archive Upload (via process_creation)

Suspicious Watering Hole Exfiltration to Fake wp-includes Endpoint via SilentSelfie

Windows Executable Connects to portmap.io Domain Over Network

Pivot detection · T1041 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-initiates-network-connection-to-portmap-io-domain-07837ab9

title: Windows Executable Connects to portmap.io Domain Over Network
id: 19e2f55f-2b26-4edf-8241-ffffa04d72db
status: test
description: This rule identifies outbound network connections where a Windows process initiates communication to a destination hostname ending with .portmap.io. Such traffic may indicate command-and-control or data exfiltration attempts, especially when the destination domain is unexpected for the host. Detection relies on network connection telemetry containing the initiating process and the destination hostname.
references:
  - https://portmap.io/
  - https://github.com/rapid7/metasploit-framework/issues/11337
  - https://pro.twitter.com/JaromirHorejsi/status/1795001037746761892/photo/2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_portmap.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2024-05-31
tags:
  - attack.t1041
  - attack.command-and-control
  - attack.t1090.002
  - attack.exfiltration
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith: .portmap.io
  condition: selection
falsepositives:
  - Legitimate use of portmap.io domains
level: medium
license: DRL-1.1
related:
  - id: 07837ab9-60e1-481f-a74d-c31fb496a94c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL