Sigma high test sigma

Potentially Suspicious Malware Callback Communication - Linux

Detects programs that connect to known malware callback ports based on threat intelligence reports.

View Source

Detection Logic

{
  "selection": {
    "Initiated": "true",
    "DestinationPort": [
      888,
      999,
      2200,
      2222,
      4000,
      4444,
      6789,
      8531,
      50501,
      51820
    ]
  },
  "filter_main_local_ranges": {
    "DestinationIp
| cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...