suspicious_typical_malware_back_connect_ports

rule suspicious_typical_malware_back_connect_ports {
 meta:
    author = "Florian Roth"
    description = "Detects programs that connect to typical malware back connect ports based on statistical analysis from two different sandbox system databases  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/Fez3THlKv4DT"
    version = "0.01"
    created = "2017/03/19"
    product = "windows"
    service = "sysmon"
    mitre = "command_and_control, t1043"

  events:
(($selection.metadata.product_event_type = "3" and ($selection.target.port = "4443" or $selection.target.port = "2448" or $selection.target.port = "8143" or $selection.target.port = "1777" or $selection.target.port = "1443" or $selection.target.port = "243" or $selection.target.port = "65535" or $selection.target.port = "13506" or $selection.target.port = "3360" or $selection.target.port = "200" or $selection.target.port = "198" or $selection.target.port = "49180" or $selection.target.port = "13507" or $selection.target.port = "6625" or $selection.target.port = "4444" or $selection.target.port = "4438" or $selection.target.port = "1904" or $selection.target.port = "13505" or $selection.target.port = "13504" or $selection.target.port = "12102" or $selection.target.port = "9631" or $selection.target.port = "5445" or $selection.target.port = "2443" or $selection.target.port = "777" or $selection.target.port = "13394" or $selection.target.port = "13145" or $selection.target.port = "12103" or $selection.target.port = "5552" or $selection.target.port = "3939" or $selection.target.port = "3675" or $selection.target.port = "666" or $selection.target.port = "473" or $selection.target.port = "5649" or $selection.target.port = "4455" or $selection.target.port = "4433" or $selection.target.port = "1817" or $selection.target.port = "100" or $selection.target.port = "65520" or $selection.target.port = "1960" or $selection.target.port = "1515" or $selection.target.port = "743" or $selection.target.port = "700" or $selection.target.port = "14154" or $selection.target.port = "14103" or $selection.target.port = "14102" or $selection.target.port = "12322" or $selection.target.port = "10101" or $selection.target.port = "7210" or $selection.target.port = "4040" or $selection.target.port = "9943")) and not ((re.regex($selection.target.process.file.full_path, `.*\\Program Files.*`) or ((re.regex($selection.target.ip, `10\..*`) or re.regex($selection.target.ip, `192\.168\..*`) or re.regex($selection.target.ip, `172\.16\..*`) or re.regex($selection.target.ip, `172\.17\..*`) or re.regex($selection.target.ip, `172\.18\..*`) or re.regex($selection.target.ip, `172\.19\..*`) or re.regex($selection.target.ip, `172\.20\..*`) or re.regex($selection.target.ip, `172\.21\..*`) or re.regex($selection.target.ip, `172\.22\..*`) or re.regex($selection.target.ip, `172\.23\..*`) or re.regex($selection.target.ip, `172\.24\..*`) or re.regex($selection.target.ip, `172\.25\..*`) or re.regex($selection.target.ip, `172\.26\..*`) or re.regex($selection.target.ip, `172\.27\..*`) or re.regex($selection.target.ip, `172\.28\..*`) or re.regex($selection.target.ip, `172\.29\..*`) or re.regex($selection.target.ip, `172\.30\..*`) or re.regex($selection.target.ip, `172\.31\..*`) or re.regex($selection.target.ip, `127\..*`)) and $selection.target.ip = "false"))))

  condition:
    $selection
}