Windows: wordpad.exe Makes Outbound Network Connections to Uncommon Ports

Alerts when wordpad.exe initiates outbound connections on destination ports outside common C2-related ports.

FreeUnreviewedSigmamediumv1

windows-wordpad-exe-makes-outbound-network-connections-to-uncommon-ports-786cdae8

title: "Windows: wordpad.exe Makes Outbound Network Connections to Uncommon Ports"
id: fe8d330f-04b9-46cd-b77a-2548db1a46f9
status: test
description: This rule flags outbound connections initiated by wordpad.exe when the destination port is not part of a defined set of common ports. Attackers may abuse a legitimate Windows process for stealthy command-and-control or to support secondary activity such as payload staging. The detection relies on Windows network connection telemetry that includes the initiating process and destination port.
references:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_wordpad_uncommon_ports.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-07-12
modified: 2023-12-15
tags:
  - attack.command-and-control
  - attack.stealth
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    Image|endswith: \wordpad.exe
  filter_main_ports:
    DestinationPort:
      - 80
      - 139
      - 443
      - 445
      - 465
      - 587
      - 993
      - 995
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Other ports can be used, apply additional filters accordingly
level: medium
license: DRL-1.1
related:
  - id: 786cdae8-fefb-4eb2-9227-04e34060db01
    type: derived

What it detects

This rule flags outbound connections initiated by wordpad.exe when the destination port is not part of a defined set of common ports. Attackers may abuse a legitimate Windows process for stealthy command-and-control or to support secondary activity such as payload staging. The detection relies on Windows network connection telemetry that includes the initiating process and destination port.

Known false positives

Other ports can be used, apply additional filters accordingly

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.