PUA - Netcat Suspicious Execution — Sigma Rule

Rule metadata and linked tags

Author: frack113, Florian Roth (Nextron Systems). Source status: test; severity: high. Source dates: 2021-07-21 / 2023-02-08.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: ed510e9dba1b4f4bf17d6e71282783006c71f5401611e4c8c7d894f696bb4f31

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: PUA - Netcat Suspicious Execution
id: e31033fc-33f0-4020-9a16-faf9b31cbf08
status: test
description: Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
references:
    - https://nmap.org/ncat/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md
    - https://www.revshells.com/
author: frack113, Florian Roth (Nextron Systems)
date: 2021-07-21
modified: 2023-02-08
tags:
    - attack.command-and-control
    - attack.t1095
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        # can not use OriginalFileName as is empty
        Image|endswith:
            - '\nc.exe'
            - '\ncat.exe'
            - '\netcat.exe'
    selection_cmdline:
        # Typical command lines
        CommandLine|contains:
            - ' -lvp '
            - ' -lvnp'
            - ' -l -v -p '
            - ' -lv -p '
            - ' -l --proxy-type http '
            # - ' --exec cmd.exe ' # Not specific enough for netcat
            - ' -vnl --exec '
            - ' -vnl -e '
            - ' --lua-exec '
            - ' --sh-exec '
    condition: 1 of selection_*
falsepositives:
    - Legitimate ncat use
level: high

Original YAML and metadata in JSON

False positives

• Legitimate ncat use

Source references

• https://nmap.org/ncat/
• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md
• https://www.revshells.com/