Non-browser process opening outbound TLS to an external host

Siemphony@siemphonymediumT1048.002unverifiedPlaybook · Collection and exfiltration

Flags outbound TLS/HTTPS connections initiated by transfer utilities, scripting hosts and LOLBins rather than by a browser or mail client, which is the network leg of MITRE's AN1413 chain. The analytic's real observable is a correlation — a staging or compression event followed within TimeWindow by the encrypted connection — and Sigma has no construct for that, so only the encrypted-egress precursor is expressed here and the staging leg has to be added by the analyst. `Initiated` pins the event to a connection this host made, and the destination ports are the common TLS listeners, so the rule stays inside the fields Sysmon EventID 3 actually carries instead of faking certificate context it does not have. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0512, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 2 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Non-browser process opening outbound TLS to an external host2id: 9cdfb0b2-4715-45ae-b14b-c06069965b133status: experimental4description: |5  Flags outbound TLS/HTTPS connections initiated by transfer utilities, scripting6  hosts and LOLBins rather than by a browser or mail client, which is the network7  leg of MITRE's AN1413 chain. The analytic's real observable is a correlation —8  a staging or compression event followed within TimeWindow by the encrypted9  connection — and Sigma has no construct for that, so only the encrypted-egress10  precursor is expressed here and the staging leg has to be added by the analyst.11  `Initiated` pins the event to a connection this host made, and the destination12  ports are the common TLS listeners, so the rule stays inside the fields Sysmon13  EventID 3 actually carries instead of faking certificate context it does not have.14  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0512, not hand-written and not tested by its author. Any lab result is on this rule's own page.15references:16  - https://attack.mitre.org/techniques/T1048/00217  - https://attack.mitre.org/detectionstrategies/DET051218author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)19date: 2026-08-1620tags:21  - attack.exfiltration22  - attack.t1048.00223logsource:24  category: network_connection25  product: windows26detection:27  selection_process:28    Image|endswith:29      - '\curl.exe'30      - '\wget.exe'31      - '\certutil.exe'32      - '\powershell.exe'33      - '\pwsh.exe'34      - '\cscript.exe'35      - '\wscript.exe'36      - '\mshta.exe'37      - '\rundll32.exe'38      - '\regsvr32.exe'39      - '\python.exe'40      - '\pythonw.exe'41      - '\winscp.exe'42      - '\rclone.exe'43  selection_tls:44    Initiated: 'true'45    DestinationPort:46      - 44347      - 844348      - 944349  condition: selection_process and selection_tls50falsepositives:51  - "Software updaters, telemetry agents and package managers that shell out to curl.exe, bitsadmin.exe or a bundled python.exe to fetch content over HTTPS. MITRE's BinaryAllowlist knob exists for exactly this — allowlist the updater by full image path rather than by file name, since the file name is what an adversary copies."52  - "Administrative and CI automation written in PowerShell that calls Invoke-RestMethod or Invoke-WebRequest against a SaaS or internal API. These are indistinguishable from exfiltration at the Sysmon EventID 3 level; the ConnectionDestinationScope idea behind MITRE's tuning is to keep the rule to destinations outside your corporate ranges, which this rule cannot express."53  - "Backup and sync tooling such as rclone or WinSCP running on a schedule against an approved cloud endpoint, which produces a steady stream of matches on exactly the ports and processes selected here."54level: medium

Splunk · SPL

Run this as a search.

index=* ((Image="*\\curl.exe" OR Image="*\\wget.exe" OR Image="*\\certutil.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cscript.exe" OR Image="*\\wscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\python.exe" OR Image="*\\pythonw.exe" OR Image="*\\winscp.exe" OR Image="*\\rclone.exe") AND (Initiated="true" AND (DestinationPort="443" OR DestinationPort="8443" OR DestinationPort="9443")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,network_connection,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\curl\.exe$|\\wget\.exe$|\\certutil\.exe$|\\powershell\.exe$|\\pwsh\.exe$|\\cscript\.exe$|\\wscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\python\.exe$|\\pythonw\.exe$|\\winscp\.exe$|\\rclone\.exe$)</field>    <field name="Initiated" type="pcre2">(?i)^true$</field>    <field name="DestinationPort" type="pcre2">(?i)(^443$|^8443$|^9443$)</field>    <description>Non-browser process opening outbound TLS to an external host</description>    <mitre>      <id>T1048.002</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. `Initiated` has no Sentinel column: Defender expresses connection direction in `ActionType`, not as a boolean column, so `Initiated` cannot be renamed — it needs a different predicate. The Sigma source is on the first tab, unchanged.

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. `Initiated` has no ECS field: ECS expresses connection direction as `network.direction` with values like `egress`, not as a boolean, so `Initiated` needs a different predicate rather than a rename. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: network_connection / windows
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 2 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 9cdfb0b2-4715-45ae-b14b-c06069965b13

ATT&CKT1048.002

T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1048.002, evaluated against their network_connection events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's `BinaryAllowlist` knob, populated by you: allow-list by *full image
MITRE's `ConnectionDestinationScope` knob (named on the Linux analytic
Split powershell.exe, pwsh.exe and rundll32.exe into a lower-level variant
Treat the three-port list as a surface, not a boundary. TLS runs anywhere;
Knobs that could not be implemented: `TimeWindow` (no cross-source join),

Declared by the author

Software updaters, telemetry agents and package managers that shell out to curl.exe, bitsadmin.exe or a bundled python.exe to fetch content over HTTPS. MITRE's BinaryAllowlist knob exists for exactly this — allowlist the updater by full image path rather than by file name, since the file name is what an adversary copies.
Administrative and CI automation written in PowerShell that calls Invoke-RestMethod or Invoke-WebRequest against a SaaS or internal API. These are indistinguishable from exfiltration at the Sysmon EventID 3 level; the ConnectionDestinationScope idea behind MITRE's tuning is to keep the rule to destinations outside your corporate ranges, which this rule cannot express.
Backup and sync tooling such as rclone or WinSCP running on a schedule against an approved cloud endpoint, which produces a steady stream of matches on exactly the ports and processes selected here.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

A Sysmon EventID 3 network connection where the process that opened the socket is a transfer utility, script host or LOLBin, and the destination port is one of the usual TLS listeners. MITRE's AN1413 describes four things at once: a non-browser process, making an encrypted outbound connection, to an unfamiliar destination, following a staging or compression event. Only the first is expressible in a single Sigma rule. The second is approximated by a port number. The third and fourth are not here at all — they are a destination baseline and a cross-log-source correlation, and Sigma has no construct for either. Read the title honestly against the logic. It says "to an external host"; the detection has no destination constraint whatsoever. Every hit against an internal LDAPS controller, WSUS, SCCM or a corporate proxy satisfies it, and on a proxied estate every single match is the proxy IP. The reviewer marked this as a logic-correctness finding, and it is the first thing to fix.

02 · Telemetry you need

**Sysmon EventID 3 with network logging enabled and not filtered for these
Three fields, all real for EID 3: Image, Initiated, DestinationPort.
What you do not have: certificate issuer, byte volume, direction of data.

03 · How the logic works

Two selections, ANDed:

Why the AND is the rule. selection_process alone is "a script host touched the network" — true thousands of times a day. selection_tls alone is "something made an HTTPS connection", which is essentially all outbound traffic. Neither half is a detection; the join is. Why `Initiated: 'true'`. EID 3 logs both ends of a connection the host was party to. Without this the rule also matches inbound accepts on 443 by any local listener, which is not the behaviour at all. Where MITRE stops and the author starts. MITRE named the BinaryAllowlist knob. The fifteen image names are the author's list, assembled to stand for "non-browser"; nothing in the brief supplies them. What the rule cannot see. Direction. curl.exe https://cdn/tool.exe -o payload.exe — a download, the exact opposite of exfiltration — matches as well as an upload does. The same event set is also T1105 and T1071.001. Treat this as T1048-generic, not as the asymmetric-encryption sub-technique.

04 · Common false positives

powershell.exe to :443 is a per-host, all-day event on any managed estate —
rundll32.exe is the generic host for shell, COM, WebDAV and print components
python.exe on a developer machine: every pip and conda call is a 443
Backup and sync tooling (rclone.exe, winscp.exe) on a schedule against an

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0512 and never executed against a log line. The medium level is a judgement, not a measured false-positive rate. One caution specific to this rule: check translations.json before trusting the Sentinel render. It targets DeviceNetworkEvents and maps Image and DestinationPort to that table's columns, but still emits Initiated =~ "true" — and DeviceNetworkEvents has no Initiated column. The KQL is syntactically valid and would return zero rows forever. A correct rule can still ship a broken query. To reach
tier_2: confirm EID 3 is actually collected for these images, add the RFC1918 exclusion so the title is true, baseline a week of volume per image, then turn the survivors into named allow-list entries.
tier_3: restores MITRE's chain — staging correlated with the transfer inside a TimeWindow — which needs a correlation engine, not Sigma.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/9cdfb0b2-4715-45ae-b14b-c06069965b13

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Non-browser process opening outbound TLS to an external host

The detection

detection.yml

Splunk · SPL

Wazuh · XML rule

Sentinel · KQL

Elastic · ES|QL

Community

Verdicts from engineers who deployed it