Detection rules › Sigma

Suspicious Wordpad Outbound Connections

Severity
medium
Author
X__Junior (Nextron Systems)
Source
upstream

Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms.

Event coverage

ProviderEvent IDTitle
Sysmon3Network connection

Stages and Predicates

Stage 1: selection

Image|endswith: '\wordpad.exe'
Initiated: true

Stage 2: not 1 of filter_main_ports

DestinationPort: [139, 443, 445, 465, 587, 80, 993, 995]

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
DestinationPorteq
  • 139 corpus 2 (sigma 2)
  • 443 corpus 7 (sigma 7)
  • 445 corpus 3 (sigma 3)
  • 465 corpus 3 (sigma 3)
  • 587 corpus 4 (sigma 4)
  • 80 corpus 6 (sigma 6)
  • 993 corpus 3 (sigma 3)
  • 995 corpus 3 (sigma 3)
Imageends_with
  • \wordpad.exe corpus 5 (sigma 5)
Initiatedeq
  • true corpus 40 (sigma 40)