MITRE ATT&CK technique
Non-Standard Port detection rulesT1571
Non-Standard Port (T1571) is a MITRE ATT&CK technique in the Command and Control tactic. This page lists the 5 community-maintained Sigma detection rules in the library mapped to T1571 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows, linux, zeek.
Tactic
Potentially Suspicious Malware Callback Communication
highDetects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases
windows · network_connection
Potentially Suspicious Malware Callback Communication - Linux
highDetects programs that connect to known malware callback ports based on threat intelligence reports.
linux · network_connection
Communication To Uncommon Destination Ports
mediumDetects programs that connect to uncommon destination ports
windows · network_connection
Suspicious DNS Z Flag Bit Set
mediumThe DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused). Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare. Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward. Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering. This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'
zeek
Testing Usage of Uncommonly Used Port
mediumAdversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443.
windows · ps_script