Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_network_connection" AND (IS_INITIATED = "true" AND PROCESSNAME contains ":\$Recycle.bin,:\Perflogs\,:\Temp\,:\Users\Default\,:\Windows\Fonts\,:\Windows\IME\,:\Windows\System32\Tasks\,:\Windows\Tasks\,\config\systemprofile\,\Windows\addins") AND (DESTINATIONHOST notendswith ".githubusercontent.com,anonfiles.com,cdn.discordapp.com,ddns.net,dl.dropboxusercontent.com,ghostbin.co,glitch.me,gofile.io,hastebin.com,mediafire.com,mega.co.nz,mega.nz,onrender.com,pages.dev,paste.ee,pastebin.com" OR DESTINATIONHOST notendswith "pastebin.pl,pastetext.net,portmap.io,privatlab.com,privatlab.net,send.exploit.in,sendspace.com,storage.googleapis.com,storjshare.io,supabase.co,temp.sh,transfer.sh,trycloudflare.com,ufile.io,w3spaces.com,workers.dev") select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.PROCESSNAME,Action1.DESTINATIONHOST,Action1.DESTINATION_IPV6,Action1.DEST_IP,Action1.SOURCEHOST,Action1.SOURCE_IP,Action1.SOURCE_IPV6
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
