Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location

  1title: Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
  2id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
  3related:
  4    - id: 8b48ad89-10d8-4382-a546-50588c410f0d
  5      type: similar
  6    - id: d635249d-86b5-4dad-a8c7-d7272b788586
  7      type: similar
  8    - id: 52182dfb-afb7-41db-b4bc-5336cb29b464
  9      type: similar
 10    - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99
 11      type: similar
 12    - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
 13      type: similar
 14    - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c
 15      type: similar
 16    - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794
 17      type: similar
 18    - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb
 19      type: similar
 20    - id: b6e04788-29e1-4557-bb14-77f761848ab8
 21      type: similar
 22    - id: a0d7e4d2-bede-4141-8896-bc6e237e977c
 23      type: similar
 24    - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
 25      type: similar
 26status: test
 27description: |
 28        Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.
 29references:
 30    - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
 31author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
 32date: 2017-03-19
 33modified: 2026-03-29
 34tags:
 35    - attack.command-and-control
 36    - attack.t1105
 37logsource:
 38    category: network_connection
 39    product: windows
 40detection:
 41    selection:
 42        Initiated: 'true'
 43        Image|contains:
 44            - ':\$Recycle.bin'
 45            - ':\Perflogs\'
 46            - ':\Temp\'
 47            - ':\Users\Default\'
 48            - ':\Users\Public\'
 49            - ':\Windows\Fonts\'
 50            - ':\Windows\IME\'
 51            - ':\Windows\System32\Tasks\'
 52            - ':\Windows\Tasks\'
 53            - '\config\systemprofile\'
 54            - '\Contacts\'
 55            - '\Favorites\'
 56            - '\Favourites\'
 57            - '\Music\'
 58            - '\Pictures\'
 59            - '\Videos\'
 60            - '\Windows\addins\'
 61    filter_main_domains:
 62        # Note: We exclude these domains to avoid duplicate filtering from e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
 63        DestinationHostname|endswith:
 64            - '.githubusercontent.com'       # Includes both gists and github repositories / Michael Haag (idea)
 65            - '0x0.st'
 66            - 'anonfiles.com'
 67            - 'bashupload.com'
 68            - 'cdn.discordapp.com'
 69            - 'chunk.io'
 70            - 'ddns.net'
 71            - 'dl.dropboxusercontent.com'
 72            - 'ghostbin.co'
 73            - 'github.com'
 74            - 'glitch.me'
 75            - 'gofile.io'
 76            - 'hastebin.com'
 77            - 'mediafire.com'
 78            - 'mega.co.nz'
 79            - 'mega.nz'
 80            - 'onrender.com'
 81            - 'pages.dev'
 82            - 'paste.ee'
 83            - 'pastebin.com'
 84            - 'pastebin.pl'
 85            - 'pastetext.net'
 86            - 'portmap.io'  # https://pro.twitter.com/JaromirHorejsi/status/1795001037746761892/photo/2
 87            - 'privatlab.com'
 88            - 'privatlab.net'
 89            - 'send.exploit.in'
 90            - 'sendspace.com'
 91            - 'storage.googleapis.com'
 92            - 'storjshare.io'
 93            - 'supabase.co'
 94            - 'temp.sh'
 95            - 'transfer.sh'
 96            - 'trycloudflare.com'
 97            - 'ufile.io'
 98            - 'w3spaces.com'
 99            - 'workers.dev'
100            - 'x0.at'
101    condition: selection and not 1 of filter_main_*
102falsepositives:
103    - Unknown
104level: high