title: Suspicious Typical Malware Back Connect Ports
id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382
status: test
description: Detects programs that connect to typical malware back connect ports based on statistical analysis from two different sandbox system databases
author: Florian Roth
references:
  - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
date: 2017/03/19
modified: 2022/02/02
logsource:
  category: network_connection
  product: windows
  definition: 'Use the following config to generate the necessary Event ID 10 Process Access events: <ProcessAccess onmatch="include"><CallTrace condition="contains">VBE7.DLL</CallTrace></ProcessAccess><ProcessAccess onmatch="exclude"><CallTrace condition="excludes">UNKNOWN</CallTrace></ProcessAccess>'
detection:
  selection:
    Initiated: 'true'
    DestinationPort:
      - '4443'
      - '2448'
      - '8143'
      - '1777'
      - '1443'
      - '243'
      - '65535'
      - '13506'
      - '3360'
      - '200'
      - '198'
      - '49180'
      - '13507'
      - '6625'
      - '4444'
      - '4438'
      - '1904'
      - '13505'
      - '13504'
      - '12102'
      - '9631'
      - '5445'
      - '2443'
      - '777'
      - '13394'
      - '13145'
      - '12103'
      - '5552'
      - '3939'
      - '3675'
      - '666'
      - '473'
      - '5649'
      - '4455'
      - '4433'
      - '1817'
      - '100'
      - '65520'
      - '1960'
      - '1515'
      - '743'
      - '700'
      - '14154'
      - '14103'
      - '14102'
      - '12322'
      - '10101'
      - '7210'
      - '4040'
      - '9943'
  filter1:
    Image|contains: '\Program Files'
  filter2:
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
      - '127.'
  condition: selection and not 1 of filter*
falsepositives:
  - Unknown
level: medium
tags:
  - attack.command_and_control
  - attack.t1571
