
title: Suspicious Typical Malware Back Connect Ports
author: Florian Roth
date: 2017/03/19
description: Detects programs that connect to typical malware back connect ports based
  on statistical analysis from two different sandbox system databases
detection:
  SELECTION_1:
    EventID: 3
  SELECTION_2:
    Initiated: 'true'
  SELECTION_3:
    DestinationPort:
    - '4443'
    - '2448'
    - '8143'
    - '1777'
    - '1443'
    - '243'
    - '65535'
    - '13506'
    - '3360'
    - '200'
    - '198'
    - '49180'
    - '13507'
    - '6625'
    - '4444'
    - '4438'
    - '1904'
    - '13505'
    - '13504'
    - '12102'
    - '9631'
    - '5445'
    - '2443'
    - '777'
    - '13394'
    - '13145'
    - '12103'
    - '5552'
    - '3939'
    - '3675'
    - '666'
    - '473'
    - '5649'
    - '4455'
    - '4433'
    - '1817'
    - '100'
    - '65520'
    - '1960'
    - '1515'
    - '743'
    - '700'
    - '14154'
    - '14103'
    - '14102'
    - '12322'
    - '10101'
    - '7210'
    - '4040'
    - '9943'
  SELECTION_4:
    EventID: 3
  SELECTION_5:
    Image: '*\Program Files*'
  SELECTION_6:
    DestinationIp:
    - 10.*
    - 192.168.*
    - 172.16.*
    - 172.17.*
    - 172.18.*
    - 172.19.*
    - 172.20.*
    - 172.21.*
    - 172.22.*
    - 172.23.*
    - 172.24.*
    - 172.25.*
    - 172.26.*
    - 172.27.*
    - 172.28.*
    - 172.29.*
    - 172.30.*
    - 172.31.*
    - 127.*
  SELECTION_7:
    DestinationIsIpv6: 'false'
  condition: (SELECTION_1 and (SELECTION_2 and SELECTION_3) and  not ((SELECTION_4
    and (SELECTION_5 or (SELECTION_6 and SELECTION_7)))))
falsepositives:
- unknown
id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382
level: medium
logsource:
  category: network_connection
  definition: 'Use the following config to generate the necessary Event ID 10 Process
    Access events: <ProcessAccess onmatch="include"><CallTrace condition="contains">VBE7.DLL</CallTrace></ProcessAccess><ProcessAccess
    onmatch="exclude"><CallTrace condition="excludes">UNKNOWN</CallTrace></ProcessAccess>'
  product: windows
modified: 2020/08/24
references:
- https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
status: experimental
tags:
- attack.command_and_control
- attack.t1571
- attack.t1043
ruletype: SIGMA
