Script host or LOLBin connecting outbound to a proxy port

Siemphony@siemphonymediumT1090.002unverifiedPlaybook · Command and control

Matches the network leg of MITRE's AN0922: one of the script hosts or signed LOLBins the analytic names opening an outbound socket to a port that only a relay, SOCKS listener or forward proxy normally answers on, with destinations inside RFC1918 and link-local space subtracted. That subtraction is what makes this External Proxy and not T1090.001 Internal Proxy, and the log source is what keeps it distinct from the published T1090 rule, which matches Linux execve records for socat and ncat command lines; the address filter is a coarse stand-in for MITRE's DestinationASN knob, and an estate that routes public address space internally will need it replaced with its own ranges. The process list is restricted to binaries that perform their own HTTP in process, because Sysmon EventID 3 names the owner of the socket rather than the tool that was typed — bitsadmin.exe is absent because the BITS service in svchost.exe does the transfer, and scp.exe and sftp.exe are absent because ssh.exe owns the connection, so all three would be selectors that can never fire. Where the estate configures an explicit web proxy, every one of these requests terminates on that internal proxy instead of on the real destination and is removed by the private-address filter, so on such a fleet the rule is blind rather than quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0325, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 2 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Script host or LOLBin connecting outbound to a proxy port2id: 179f7391-1355-437a-8d66-7f22fda8285b3status: experimental4description: |5  Matches the network leg of MITRE's AN0922: one of the script hosts or signed6  LOLBins the analytic names opening an outbound socket to a port that only a7  relay, SOCKS listener or forward proxy normally answers on, with destinations8  inside RFC1918 and link-local space subtracted. That subtraction is what makes9  this External Proxy and not T1090.001 Internal Proxy, and the log source is10  what keeps it distinct from the published T1090 rule, which matches Linux11  execve records for socat and ncat command lines; the address filter is a coarse12  stand-in for MITRE's DestinationASN knob, and an estate that routes public13  address space internally will need it replaced with its own ranges. The process14  list is restricted to binaries that perform their own HTTP in process, because15  Sysmon EventID 3 names the owner of the socket rather than the tool that was16  typed — bitsadmin.exe is absent because the BITS service in svchost.exe does17  the transfer, and scp.exe and sftp.exe are absent because ssh.exe owns the18  connection, so all three would be selectors that can never fire. Where the19  estate configures an explicit web proxy, every one of these requests terminates20  on that internal proxy instead of on the real destination and is removed by the21  private-address filter, so on such a fleet the rule is blind rather than quiet.22  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0325, not hand-written and not tested by its author. Any lab result is on this rule's own page.23references:24  - https://attack.mitre.org/techniques/T1090/00225  - https://attack.mitre.org/detectionstrategies/DET032526author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)27date: 2026-08-1628tags:29  - attack.command-and-control30  - attack.t1090.00231logsource:32  category: network_connection33  product: windows34detection:35  selection_lolbin:36    Image|endswith:37      - '\rundll32.exe'38      - '\mshta.exe'39      - '\wscript.exe'40      - '\cscript.exe'41      - '\regsvr32.exe'42      - '\certutil.exe'43  selection_proxy_port:44    Initiated: 'true'45    DestinationPort:46      - 108047      - 312848      - 444449      - 808050      - 808151      - 888852      - 900153      - 905054      - 905155      - 915056  filter_internal_destination:57    DestinationIp|startswith:58      - '10.'59      - '127.'60      - '169.254.'61      - '172.16.'62      - '172.17.'63      - '172.18.'64      - '172.19.'65      - '172.20.'66      - '172.21.'67      - '172.22.'68      - '172.23.'69      - '172.24.'70      - '172.25.'71      - '172.26.'72      - '172.27.'73      - '172.28.'74      - '172.29.'75      - '172.30.'76      - '172.31.'77      - '192.168.'78      - 'fd'79      - 'fe80:'80      - '::1'81  condition: selection_lolbin and selection_proxy_port and not filter_internal_destination82falsepositives:83  - "An externally hosted web gateway or cloud filtering service published on 3128 or 8080. Where the estate uses one, every scripted or LOLBin-hosted request reaches it on a public address and matches, which makes it the rule's dominant volume and the reason the level is medium rather than high."84  - "Vendor installers, patching agents and management tooling that hand a download to certutil.exe or to a rundll32-hosted component against a distribution endpoint published on 8080 or 8081."85  - "Developer, QA and monitoring scripts run under wscript.exe or cscript.exe that call an external partner API, staging service or test endpoint on a non-standard port."86  - "Privacy and threat-research tooling on analyst workstations that routes traffic through an external anonymising relay on 9050 or 9150, which is the same shape as the behaviour being hunted."87level: medium

Splunk · SPL

Run this as a search.

index=* (((Image="*\\rundll32.exe" OR Image="*\\mshta.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe") AND (Initiated="true" AND (DestinationPort="1080" OR DestinationPort="3128" OR DestinationPort="4444" OR DestinationPort="8080" OR DestinationPort="8081" OR DestinationPort="8888" OR DestinationPort="9001" OR DestinationPort="9050" OR DestinationPort="9051" OR DestinationPort="9150"))) AND NOT ((DestinationIp="10.*" OR DestinationIp="127.*" OR DestinationIp="169.254.*" OR DestinationIp="172.16.*" OR DestinationIp="172.17.*" OR DestinationIp="172.18.*" OR DestinationIp="172.19.*" OR DestinationIp="172.20.*" OR DestinationIp="172.21.*" OR DestinationIp="172.22.*" OR DestinationIp="172.23.*" OR DestinationIp="172.24.*" OR DestinationIp="172.25.*" OR DestinationIp="172.26.*" OR DestinationIp="172.27.*" OR DestinationIp="172.28.*" OR DestinationIp="172.29.*" OR DestinationIp="172.30.*" OR DestinationIp="172.31.*" OR DestinationIp="192.168.*" OR DestinationIp="fd*" OR DestinationIp="fe80:*" OR DestinationIp="::1*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,network_connection,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\rundll32\.exe$|\\mshta\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\regsvr32\.exe$|\\certutil\.exe$)</field>    <field name="Initiated" type="pcre2">(?i)^true$</field>    <field name="DestinationPort" type="pcre2">(?i)(^1080$|^3128$|^4444$|^8080$|^8081$|^8888$|^9001$|^9050$|^9051$|^9150$)</field>    <field name="DestinationIp" negate="yes" type="pcre2">(?i)(^10\.|^127\.|^169\.254\.|^172\.16\.|^172\.17\.|^172\.18\.|^172\.19\.|^172\.20\.|^172\.21\.|^172\.22\.|^172\.23\.|^172\.24\.|^172\.25\.|^172\.26\.|^172\.27\.|^172\.28\.|^172\.29\.|^172\.30\.|^172\.31\.|^192\.168\.|^fd|^fe80:|^::1)</field>    <description>Script host or LOLBin connecting outbound to a proxy port</description>    <mitre>      <id>T1090.002</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. `Initiated` has no Sentinel column: Defender expresses connection direction in `ActionType`, not as a boolean column, so `Initiated` cannot be renamed — it needs a different predicate. The Sigma source is on the first tab, unchanged.

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. `Initiated` has no ECS field: ECS expresses connection direction as `network.direction` with values like `egress`, not as a boolean, so `Initiated` needs a different predicate rather than a rename. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: network_connection / windows
Level: medium
Category: reverse_shell
Sigma status: experimental
Backends: 2 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 179f7391-1355-437a-8d66-7f22fda8285b

ATT&CKT1090.002

T1090.002External Proxy

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1090.002, evaluated against their network_connection events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's AN0922 names three knobs — DestinationASN, ParentProcess, EntropyThreshold — but supplies no values for any of them. This rule implements only a rough substitute for the first: the private/link-local IP list stands in for DestinationASN, is the rule author's own list, and needs replacing with real internal ranges on any estate that routes public address space internally. ParentProcess and EntropyThreshold aren't implemented at all — a real gap, not a design choice. The bigger tuning problem review.json flagged: the ten ports are fixed and low-numbered. Real proxy C2 increasingly prefers 443 or 80 specifically to blend into normal HTTPS traffic, and a connection on either port never matches DestinationPort here — the rule goes silent with no signal that it's blind rather than quiet. Treat the port list as a starting set to extend, not a ceiling.

Declared by the author

An externally hosted web gateway or cloud filtering service published on 3128 or 8080. Where the estate uses one, every scripted or LOLBin-hosted request reaches it on a public address and matches, which makes it the rule's dominant volume and the reason the level is medium rather than high.
Vendor installers, patching agents and management tooling that hand a download to certutil.exe or to a rundll32-hosted component against a distribution endpoint published on 8080 or 8081.
Developer, QA and monitoring scripts run under wscript.exe or cscript.exe that call an external partner API, staging service or test endpoint on a non-standard port.
Privacy and threat-research tooling on analyst workstations that routes traffic through an external anonymising relay on 9050 or 9150, which is the same shape as the behaviour being hunted.

Lessonreverse shell

reverse shellAI draft — unreviewed

01 · What this rule detects

This rule targets the network leg of MITRE's AN0922 analytic for External Proxy: a script host or signed LOLBin — rundll32.exe, mshta.exe, wscript.exe, cscript.exe, regsvr32.exe, or certutil.exe — opening an outbound connection to a port that commonly answers for a SOCKS listener, relay, or forward proxy (1080, 3128, 4444, 8080, 8081, 8888, 9001, 9050, 9051, 9150), to a destination outside private and link-local address space. It fires on a single connection event, not a pattern of beaconing over time.

02 · Telemetry you need

Sysmon EventID 3 (network_connection, product: windows), fields Image, Initiated, DestinationPort, DestinationIp. Reference Sysmon configs frequently throttle or exclude NetworkConnect events because of their volume — review.json flagged that this rule never states that prerequisite, unlike the audit-policy caveats written for the companion 4688 feeds elsewhere in this batch. Confirm NetworkConnect logging is actually turned on in your Sysmon config before trusting a quiet result from this rule; a quiet result you haven't checked the config for is not evidence of anything.

03 · How the logic works

selection_lolbin matches Image ending in one of the six binaries above. selection_proxy_port requires Initiated: 'true' (the connection was outbound-initiated) and DestinationPort in the ten-port list. filter_internal_destination subtracts RFC1918 ranges, 169.254., fd/fe80: IPv6 local space, and ::1. The condition is selection_lolbin and selection_proxy_port and not filter_internal_destination — all three must hold. Notice what is deliberately absent from selection_lolbin: bitsadmin.exe, scp.exe, sftp.exe. Those binaries never own the socket on Sysmon EID 3 — the BITS service inside svchost.exe performs the transfer, and ssh.exe owns the connection for scp/sftp — so including them would have produced selectors that can never fire. That is the exact dead-selector trap AUTHORING.md warns about, and this rule was reviewed as one that correctly avoided it.

04 · Common false positives

The rule's own top false positive is the dominant one: an externally hosted web gateway or cloud filtering service on 3128 or 8080 matches every scripted or LOLBin-hosted request that reaches it, by design — and review.json's level: medium (not high) is calibrated to exactly that volume, not to the logic being tight. Also expect vendor installers/patchers driving certutil.exe or a rundll32-hosted component to a distribution endpoint on 8080/8081; dev/QA scripts under wscript/cscript calling partner APIs on non-standard ports; and analyst privacy tooling routed through Tor on 9050/9150. Review.json adds one the rule missed entirely: remote-support tools (TeamViewer, AnyDesk, ScreenConnect) that fall back to a cloud relay on 8080/3128 when a direct peer-to-peer session fails — common in helpdesk-heavy shops.

05 · Detection maturity

tier_1: UNVERIFIED — lowest tier. This rule has never been executed against a real log. It also does not exist on Sentinel: Initiated has no equivalent Defender column, so the KQL translation is refused outright rather than silently wrong. Before relying on this anywhere, run it against real Sysmon EID 3 data first.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/179f7391-1355-437a-8d66-7f22fda8285b

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Script host or LOLBin connecting outbound to a proxy port

The detection

detection.yml

Splunk · SPL

Wazuh · XML rule

Sentinel · KQL

Elastic · ES|QL

Community

Verdicts from engineers who deployed it