Communication To Uncommon Destination Ports

Severity: medium
Author: Florian Roth (Nextron Systems)
Source: upstream

Detects programs that connect to uncommon destination ports

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1571` Non-Standard Port

Event coverage

Provider	Event ID	Title
Sysmon	3	Network connection

Stages and Predicates

Stage 1: `selection`

DestinationPort: [8080, 8888]
Initiated: true

Stage 2: `not 1 of filter_main_local_ranges`

or:
DestinationIp|cidr: '10.0.0.0/8'
DestinationIp|cidr: '127.0.0.0/8'
DestinationIp|cidr: '169.254.0.0/16'
DestinationIp|cidr: '172.16.0.0/12'
DestinationIp|cidr: '192.168.0.0/16'
DestinationIp|cidr: '::1/128'
DestinationIp|cidr: 'fc00::/7'
DestinationIp|cidr: 'fe80::/10'

Stage 3: `not 1 of filter_optional_sys_directories`

or:
Image|startswith: 'C:\Program Files (x86)\'
Image|startswith: 'C:\Program Files\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`DestinationIp`	cidr_match	`10.0.0.0/8` corpus 12 (sigma 12) `127.0.0.0/8` corpus 13 (sigma 13) `169.254.0.0/16` corpus 12 (sigma 12) `172.16.0.0/12` corpus 12 (sigma 12) `192.168.0.0/16` corpus 12 (sigma 12) `::1/128` corpus 13 (sigma 13) `fc00::/7` corpus 12 (sigma 12) `fe80::/10` corpus 12 (sigma 12)
`DestinationPort`	eq	`8080` `8888`
`Image`	starts_with	`C:\Program Files (x86)\` corpus 14 (sigma 14) `C:\Program Files\` corpus 15 (sigma 15)
`Initiated`	eq	`true` corpus 40 (sigma 40)