Skip to content
Threat Feed
Subscribe
medium advisory

Detection of LOLBAS Network Connections on Uncommon Ports

An analytic identification of Living Off the Land Binaries and Scripts (LOLBAS) initiating public network connections over non-standard destination ports, indicating potential staging or command-and-control activity.

This detection identifies Living Off the Land Binaries and Scripts (LOLBAS) that deviate from expected network communication patterns. Attackers frequently abuse native Windows binaries - such as certutil, bitsadmin, msbuild, or mshta - to perform payload downloads, establish command-and-control (C2) channels, or facilitate proxy execution. Because these binaries are digitally signed and trusted by the operating system, they are ideal for blending malicious traffic into legitimate environment activity.

This analytic leverages Sysmon Event ID 3 (Network connection) to monitor traffic generated by these specific binaries. It applies per-binary exclusions to ignore standard ports (e.g., 80, 443) that are commonly used by legitimate administrative and update workflows. When a process communicates over a non-standard port, it creates a high-signal anomaly that warrants investigation to determine if the process is being used as a vector for malicious network activity.

Impact

Successful exploitation allows attackers to bypass traditional signature-based network defenses, perform stealthy data exfiltration, or maintain persistent C2 access. These techniques are observed in various threat campaigns, including ransomware operations, remote access tool (RAT) deployments, and modular backdoor infections. If left undetected, attackers can leverage these trusted binaries to execute arbitrary code or maintain long-term access to critical enterprise segments.

Recommendation

Detection engineering teams should prioritize the integration of network traffic telemetry that includes the associated process name and destination port.

  • Implement the detection logic in your SIEM using Sysmon Event ID 3.
  • Tune the baseline of your environment by identifying and excluding legitimate software installation, support tooling, and synchronization workflows that utilize non-standard ports.
  • Use the process execution logs to provide additional context when an alert fires to confirm if the binary execution originated from a trusted source or a user-initiated command.
  • Investigate any high-risk alerts by pivoting to process lineage and external IP reputation.

Immediate actions

Deploy the provided detection logic to monitor LOLBAS network activity.

Detection Engineering 72h

Threat Hunt

Search for historical connections from the identified LOLBAS binaries to unusual destination ports.

T1218 high high confidence hunt now

Data: Network Traffic logs

Detection coverage 1

Detect LOLBAS Network Connection on Uncommon Port

medium

Detects native Windows binaries and scripts initiating network connections over ports not typically associated with their legitimate function, which may indicate malicious C2 or staging.

sigma tactics: command_and_control techniques: T1105, T1218 sources: network_connection, windows

Detection queries are available on the platform. Get full rules →