Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location

Title: Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
Status: test
Description:Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.
References:
  -https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2017-03-19
modified:2026-03-29
Tags:

• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: network_connection
• product: windows

Detection:
  selection:
    Initiated: 'true'
    Image|contains:
      -':\$Recycle.bin'
      -':\Perflogs\'
      -':\Temp\'
      -':\Users\Default\'
      -':\Users\Public\'
      -':\Windows\Fonts\'
      -':\Windows\IME\'
      -':\Windows\System32\Tasks\'
      -':\Windows\Tasks\'
      -'\config\systemprofile\'
      -'\Contacts\'
      -'\Favorites\'
      -'\Favourites\'
      -'\Music\'
      -'\Pictures\'
      -'\Videos\'
      -'\Windows\addins\'

  filter_main_domains:
    DestinationHostname|endswith:
      -'.githubusercontent.com'
      -'0x0.st'
      -'anonfiles.com'
      -'bashupload.com'
      -'cdn.discordapp.com'
      -'chunk.io'
      -'ddns.net'
      -'dl.dropboxusercontent.com'
      -'ghostbin.co'
      -'github.com'
      -'glitch.me'
      -'gofile.io'
      -'hastebin.com'
      -'mediafire.com'
      -'mega.co.nz'
      -'mega.nz'
      -'onrender.com'
      -'pages.dev'
      -'paste.ee'
      -'pastebin.com'
      -'pastebin.pl'
      -'pastetext.net'
      -'portmap.io'
      -'privatlab.com'
      -'privatlab.net'
      -'send.exploit.in'
      -'sendspace.com'
      -'storage.googleapis.com'
      -'storjshare.io'
      -'supabase.co'
      -'temp.sh'
      -'transfer.sh'
      -'trycloudflare.com'
      -'ufile.io'
      -'w3spaces.com'
      -'workers.dev'
      -'x0.at'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: high