Techniques
Sample rules
LOLBAS Network Connection On Uncommon Port
- source: splunk
- technicques:
Description
The following analytic identifies Living Off the Land Binaries and Scripts (LOLBAS) that can legitimately initiate public network connections but are communicating over uncommon destination ports. It leverages the Network Traffic data model and applies per-binary common-port exclusions to reduce false positives while preserving suspicious non-standard communication. This behavior may indicate payload download, command-and-control, proxy execution, or attempts to blend malicious traffic into trusted Windows binaries. Join this detection with the Process Execution events to provide context and avoid false positives.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
from datamodel=Network_Traffic.All_Traffic where
All_Traffic.app IN (
"*\\bitsadmin.exe",
"*\\certutil.exe",
"*\\cmstp.exe",
"*\\cscript.exe",
"*\\ftp.exe",
"*\\hh.exe",
"*\\ie4uinit.exe",
"*\\ieexec.exe",
"*\\msbuild.exe",
"*\\msdt.exe",
"*\\mshta.exe",
"*\\msiexec.exe",
"*\\presentationhost.exe",
"*\\settingsynchost.exe",
"*\\syncappvpublishingserver.exe",
"*\\workfolders.exe",
"*\\wscript.exe",
"*\\wuauclt.exe"
)
NOT All_Traffic.dest_ip IN (
"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
"100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16",
"192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
"192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32",
"192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24",
"192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4",
"192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24",
"203.0.113.0/24", "240.0.0.0/4"
)
NOT (
(
All_Traffic.app IN (
"*\\cscript.exe",
"*\\wscript.exe"
)
All_Traffic.dest_port IN ("80", "443", "3128")
)
OR
(
All_Traffic.app="*\\ftp.exe"
All_Traffic.dest_port IN ("20", "21", "989", "990")
)
OR
(
All_Traffic.app IN (
"*\\bitsadmin.exe",
"*\\certutil.exe",
"*\\cmstp.exe",
"*\\hh.exe",
"*\\ieexec.exe",
"*\\msbuild.exe",
"*\\msdt.exe",
"*\\mshta.exe",
"*\\msiexec.exe",
"*\\presentationhost.exe",
"*\\settingsynchost.exe",
"*\\syncappvpublishingserver.exe",
"*\\workfolders.exe",
"*\\wuauclt.exe"
)
All_Traffic.dest_port IN ("80", "443")
)
OR
(
All_Traffic.app IN (
"*\\certutil.exe",
"*\\ie4uinit.exe"
)
All_Traffic.dest_port IN ("389")
)
)
by All_Traffic.action All_Traffic.app All_Traffic.dest
All_Traffic.dest_ip All_Traffic.dest_port
All_Traffic.direction All_Traffic.dvc All_Traffic.protocol
All_Traffic.protocol_version All_Traffic.src
All_Traffic.src_ip All_Traffic.src_port
All_Traffic.transport All_Traffic.user
All_Traffic.vendor_product
| `drop_dm_object_name(All_Traffic)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `lolbas_network_connection_on_uncommon_port_filter`