Potentially Suspicious Malware Callback Communication

Severity: high
Author: Florian Roth (Nextron Systems)
Source: upstream

Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1571` Non-Standard Port

Event coverage

Provider	Event ID	Title
Sysmon	3	Network connection

Stages and Predicates

Stage 1: `selection`

DestinationPort: [100, 10101, 12102, 12103, 12322, 13145, 13394, 13504, 13505, 13506, 13507, 14102, 14103, 14154, 1443, 1515, 1777, 1817, 1904, 1960, 198, 200, 243, 2443, 2448, 3360, 3675, 3939, 4040, 4433, 4438, 4443, 4444, 4455, 473, 49180, 5445, 5552, 5649, 65520, 65535, 6625, 666, 700, 7210, 743, 777, 7777, 8143, 8843, 9631, 9943]
Initiated: true

Stage 2: `not 1 of filter_main_local_ranges`

or:
DestinationIp|cidr: '10.0.0.0/8'
DestinationIp|cidr: '127.0.0.0/8'
DestinationIp|cidr: '169.254.0.0/16'
DestinationIp|cidr: '172.16.0.0/12'
DestinationIp|cidr: '192.168.0.0/16'
DestinationIp|cidr: '::1/128'
DestinationIp|cidr: 'fc00::/7'
DestinationIp|cidr: 'fe80::/10'

Stage 3: `not 1 of filter_optional_sys_directories`

or:
Image|startswith: 'C:\Program Files (x86)\'
Image|startswith: 'C:\Program Files\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`DestinationIp`	cidr_match	`10.0.0.0/8` corpus 12 (sigma 12) `127.0.0.0/8` corpus 13 (sigma 13) `169.254.0.0/16` corpus 12 (sigma 12) `172.16.0.0/12` corpus 12 (sigma 12) `192.168.0.0/16` corpus 12 (sigma 12) `::1/128` corpus 13 (sigma 13) `fc00::/7` corpus 12 (sigma 12) `fe80::/10` corpus 12 (sigma 12)
`DestinationPort`	eq	`100` `10101` `12102` `12103` `12322` `13145` `13394` `13504` `13505` `13506` `13507` `14102` `14103` `14154` `1443` `1515` `1777` `1817` `1904` `1960` `198` `200` `243` `2443` `2448` `3360` `3675` `3939` `4040` `4433` `4438` `4443` `4444` `4455` `473` `49180` `5445` `5552` `5649` `65520` `65535` `6625` `666` `700` `7210` `743` `777` `7777` `8143` `8843` `9631` `9943`
`Image`	starts_with	`C:\Program Files (x86)\` corpus 14 (sigma 14) `C:\Program Files\` corpus 15 (sigma 15)
`Initiated`	eq	`true` corpus 40 (sigma 40)