Uncommon process connects to an internal host on a relay port

Siemphony@siemphonymediumT1090.001unverified

Matches MITRE's AN0204 where it is expressible in one event: a scripting or COM-loading host opening a socket to an RFC1918 address on a port associated with proxying or with implant listeners. MITRE lists cmd.exe among the anomalous processes, but Sysmon EventID 3 names the process that owns the socket and cmd.exe never opens one itself, so it is dropped here along with svchost.exe, which owns most of a host's ordinary traffic and would swamp the rule. MITRE's DestinationPort knob names 1080, 8080 and 4444; 8080 is left out because internal application and proxy traffic on it is ordinary, and 1081, 4445, 5555 and 9050 are the author's additions. The analytic's baseline element — peer hosts absent from normal communication patterns — has no single-event form, so private address space stands in for it, and note that Sysmon network-connection logging is heavily filtered in many production configurations, where an empty result reflects the feed rather than the absence of relays. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0075, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceNetworkEvents| where (((InitiatingProcessFolderPath endswith "\\rundll32.exe" or InitiatingProcessFolderPath endswith "\\regsvr32.exe" or InitiatingProcessFolderPath endswith "\\mshta.exe" or InitiatingProcessFolderPath endswith "\\wscript.exe" or InitiatingProcessFolderPath endswith "\\cscript.exe" or InitiatingProcessFolderPath endswith "\\powershell.exe" or InitiatingProcessFolderPath endswith "\\pwsh.exe") and (RemoteIP startswith "10." or RemoteIP startswith "192.168." or RemoteIP startswith "172.16." or RemoteIP startswith "172.17." or RemoteIP startswith "172.18." or RemoteIP startswith "172.19." or RemoteIP startswith "172.20." or RemoteIP startswith "172.21." or RemoteIP startswith "172.22." or RemoteIP startswith "172.23." or RemoteIP startswith "172.24." or RemoteIP startswith "172.25." or RemoteIP startswith "172.26." or RemoteIP startswith "172.27." or RemoteIP startswith "172.28." or RemoteIP startswith "172.29." or RemoteIP startswith "172.30." or RemoteIP startswith "172.31.")) and (RemotePort == 1080 or RemotePort == 1081 or RemotePort == 4444 or RemotePort == 4445 or RemotePort == 5555 or RemotePort == 9050))

Splunk · SPL

Run this as a search.

index=* (((Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\mshta.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (DestinationIp="10.*" OR DestinationIp="192.168.*" OR DestinationIp="172.16.*" OR DestinationIp="172.17.*" OR DestinationIp="172.18.*" OR DestinationIp="172.19.*" OR DestinationIp="172.20.*" OR DestinationIp="172.21.*" OR DestinationIp="172.22.*" OR DestinationIp="172.23.*" OR DestinationIp="172.24.*" OR DestinationIp="172.25.*" OR DestinationIp="172.26.*" OR DestinationIp="172.27.*" OR DestinationIp="172.28.*" OR DestinationIp="172.29.*" OR DestinationIp="172.30.*" OR DestinationIp="172.31.*")) AND (DestinationPort="1080" OR DestinationPort="1081" OR DestinationPort="4444" OR DestinationPort="4445" OR DestinationPort="5555" OR DestinationPort="9050"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe") AND (TO_LOWER(destination.ip) LIKE "10.*" OR TO_LOWER(destination.ip) LIKE "192.168.*" OR TO_LOWER(destination.ip) LIKE "172.16.*" OR TO_LOWER(destination.ip) LIKE "172.17.*" OR TO_LOWER(destination.ip) LIKE "172.18.*" OR TO_LOWER(destination.ip) LIKE "172.19.*" OR TO_LOWER(destination.ip) LIKE "172.20.*" OR TO_LOWER(destination.ip) LIKE "172.21.*" OR TO_LOWER(destination.ip) LIKE "172.22.*" OR TO_LOWER(destination.ip) LIKE "172.23.*" OR TO_LOWER(destination.ip) LIKE "172.24.*" OR TO_LOWER(destination.ip) LIKE "172.25.*" OR TO_LOWER(destination.ip) LIKE "172.26.*" OR TO_LOWER(destination.ip) LIKE "172.27.*" OR TO_LOWER(destination.ip) LIKE "172.28.*" OR TO_LOWER(destination.ip) LIKE "172.29.*" OR TO_LOWER(destination.ip) LIKE "172.30.*" OR TO_LOWER(destination.ip) LIKE "172.31.*")) AND (destination.port == 1080 OR destination.port == 1081 OR destination.port == 4444 OR destination.port == 4445 OR destination.port == 5555 OR destination.port == 9050))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,network_connection,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\rundll32\.exe$|\\regsvr32\.exe$|\\mshta\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="DestinationIp" type="pcre2">(?i)(^10\.|^192\.168\.|^172\.16\.|^172\.17\.|^172\.18\.|^172\.19\.|^172\.20\.|^172\.21\.|^172\.22\.|^172\.23\.|^172\.24\.|^172\.25\.|^172\.26\.|^172\.27\.|^172\.28\.|^172\.29\.|^172\.30\.|^172\.31\.)</field>    <field name="DestinationPort" type="pcre2">(?i)(^1080$|^1081$|^4444$|^4445$|^5555$|^9050$)</field>    <description>Uncommon process connects to an internal host on a relay port</description>    <mitre>      <id>T1090.001</id>    </mitre>  </rule></group>

At a glance

Logsource: network_connection / windows
Level: medium
Category: reverse_shell
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 312c7f4a-cb03-4270-96ac-cc49163957d7

ATT&CKT1090.001

T1090.001Internal Proxy

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonreverse shell

reverse shellAI draft — unreviewed

01 · What this rule detects

AN0204 describes an anomalous process — MITRE names rundll32, svchost, cmd — connecting to internal peer hosts absent from the environment's normal communication baseline, often on SMB, RPC, or a high port. This rule implements the single-event slice of that: a scripting or COM-loading host opening a socket to a private (RFC1918) address on a port associated with proxying or implant listeners. The baseline-deviation half of AN0204 — "not seen in typical communication patterns" — has no single-event form at all, so the rule substitutes private address space as a coarse stand-in and loses the actual anomaly signal MITRE describes.

02 · Telemetry you need

category: network_connection, product: windows — Sysmon EventID 3, copied from AN0204's first log source. The description flags that Sysmon network-connection logging is heavily filtered in many production configs, so an empty result reflects the feed, not an absence of relays. MITRE lists cmd.exe among the anomalous processes, but EID 3's Image field names the process that owns the socket, and cmd.exe never opens one itself — it's correctly dropped. svchost.exe is dropped too, for the opposite reason: it owns most of a host's ordinary traffic and would swamp the rule.

03 · How the logic works

Three selections, ANDed. selection_process matches Image|endswith against seven script/COM hosts: rundll32.exe, regsvr32.exe, mshta.exe, wscript.exe, cscript.exe, powershell.exe, pwsh.exe. selection_internal matches DestinationIp|startswith against the RFC1918 ranges. selection_port matches DestinationPort against six values: 1080, 1081, 4444, 4445, 5555, 9050. Of MITRE's DestinationPort knob, which names 1080, 8080 and 4444, only 1080 and 4444 survive — 8080 is dropped because internal application and proxy traffic on it is ordinary; 1081, 4445, 5555 and 9050 are the author's own additions, not MITRE's. The review flags a field-semantics gap the rule doesn't handle: Sysmon EID 3 logs both connection directions, and for an inbound one (Initiated: false) the roles invert — DestinationIp becomes the local host and DestinationPort the local listening port. There's no Initiated gate here, so a hit reads two different situations identically, and an analyst will default to reading the IP as the peer when it may be the box itself.

04 · Common false positives

The first false positive names an internal service bound to one of these ports and reached by scripted clients — a build agent or test harness on 5555 makes every PowerShell client on the subnet match, and can become the rule's dominant volume on its own. The second names authorised penetration tests: Metasploit's default handler is 4444, its SOCKS module is 1080, so a scheduled red-team exercise produces matching events from exactly the processes this rule watches. The review adds one the list misses entirely: scripted reachability sweeps. A Test-NetConnection or raw TcpClient loop from PowerShell across RFC1918 ranges and this port list produces one match per host per port per run — on any estate running a routine scan, that dwarfs everything in the stated list.

05 · Detection maturity

tier_1: . Derived from a scaffold with no query logic, reasoned through on paper, never run.
tier_2: run read-only, split hits by `Initiated` to separate the two directions this rule currently conflates, and rank the outbound set by `DestinationPort` and peer IP to size the internal-service and red-team volume before setting a level.
tier_3: ** build MITRE's dropped InternalConnectionPattern and TimeWindow knobs as an actual baseline-and-correlation companion, so the alert means "connection outside this host's normal peers" instead of "connection to a private address on a common port."

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

The review's sharper point is coverage, not noise: MITRE's own T1090.001 text says internal proxying often rides SMB and other trusted paths precisely to blend in, and this port list is the opposite selection — it only catches default-configured tooling on well-known implant ports. Say so in the description; a relay over 445 or 443 is structurally invisible here. Add Initiated: 'true' to selection_internal if the outbound-only reading is what's wanted, or document that inbound hits invert IP and port roles. Treat the first false-positive entry's own wording — "enough to become the rule's dominant volume" — as a signal that level: medium needs revisiting per-environment rather than assumed.

Declared by the author

An internal service bound to one of these high ports, reached by scripted clients. A build agent, test harness or management API listening on 5555 makes every PowerShell client on the subnet match, and a single such service is enough to become the rule's dominant volume in that environment.
Authorised penetration tests and control-validation runs. Metasploit's default handler port is 4444 and its SOCKS module listens on 1080, so a scheduled red-team exercise, or a purple-team test of this very technique, produces matching events from powershell.exe and rundll32.exe.
Sanctioned internal SOCKS proxies. A developer tunnel, a jump-host SOCKS listener on 1080, or an internal onion-routed service on 9050 queried by a script host looks identical to the behaviour being detected, because it is the same behaviour with different intent. MITRE's InternalConnectionPattern knob is where a known relay pair gets excluded.
Software distribution and remote-support agents that drive PowerShell to fetch content from a peer or cache host rather than from a server, which is common in branch-office and peer-to-peer distribution designs.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1090.001, evaluated against their network_connection events.

Share this rule

/u/siemphony/312c7f4a-cb03-4270-96ac-cc49163957d7

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Uncommon process connects to an internal host on a relay port

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it