Potentially Suspicious Malware Callback Communication on Linux
This detection-focused brief identifies network traffic to ports historically associated with malware C2 infrastructure, requiring security teams to baseline normal outbound connectivity on Linux hosts.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Action
- Monitor or close
- Sources
- 1 public source
- Freshness
- Revision 1Nov 10, 04:33 UTC
- Detection
- 1 rule
- Source quality
- B2Roughly even chance
This brief provides detection logic for identifying Linux network traffic directed at non-standard ports commonly utilized by various malware families and C2 frameworks such as SystemBC, Sliver, and historical Sandworm activity. Because these ports are not exclusively reserved for malicious use, they may generate false positives depending on local environment configurations and administrative tooling.
Recommendation
- Deploy the provided Sigma rule to your SIEM to monitor for outbound connections from Linux hosts to the specified ports.
- Review network logs to identify legitimate services (such as administrative tools or custom internal applications) that may be utilizing these ports to tune out false positives.
- Prioritize investigation of alerts originating from sensitive production systems or database servers that have no documented business need for non-standard outbound traffic.
Immediate actions
Deploy Sigma rule to monitor for identified ports
Threat Hunt
Identify outbound connections to non-standard ports not associated with known internal services
Data: Firewall/Netflow logs (DestinationPort, DestinationIp)
Detection coverage 1
Detect Suspicious Malware Callback Ports - Linux
mediumDetects outbound network connections from Linux hosts to ports historically associated with C2 frameworks and malware callback activity
Detection queries are available on the platform. Get full rules →