Network Communication Initiated To Portmap.IO Domain

calendar May 31, 2024 · attack.t1041 attack.command_and_control attack.t1090.002 attack.exfiltration  ·
Share on: linkedin copy

Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors

Sigma rule (View on GitHub)

 1title: Network Communication Initiated To Portmap.IO Domain
 2id: 07837ab9-60e1-481f-a74d-c31fb496a94c
 3status: experimental
 4description: Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors
 5references:
 6    - https://portmap.io/
 7    - https://github.com/rapid7/metasploit-framework/issues/11337
 8    - https://pro.twitter.com/JaromirHorejsi/status/1795001037746761892/photo/2
 9author: Florian Roth (Nextron Systems)
10date: 2024/05/31
11tags:
12    - attack.t1041
13    - attack.command_and_control
14    - attack.t1090.002
15    - attack.exfiltration
16logsource:
17    category: network_connection
18    product: windows
19detection:
20    selection:
21        Initiated: 'true'
22        DestinationHostname|endswith: '.portmap.io'
23    condition: selection
24falsepositives:
25    - Legitimate use of portmap.io domains
26level: medium

References

Related rules

to-top