Script host or proxy binary connecting to a message broker port

Siemphony@siemphonylowT1071.005unverified

AN0002's Windows leg reduced to what a single Sysmon EventID 3 record can carry: an outbound connection to a publish/subscribe broker service port opened by a scripting engine or a signed proxy binary rather than by an application that has any business speaking MQTT, AMQP, XMPP or STOMP. `Initiated`, `Image` and `DestinationPort` are all network-connection fields, so the selection evaluates on one event and no process-creation field is mixed in. Every process listed here opens its own socket, so EventID 3 names it — the port list is MITRE's ProtocolPortList knob, which names 1883, 5222 and 5672, populated here with their TLS counterparts and the STOMP pair, and the process list is the UnusualProcessList knob populated with script hosts and download-capable signed binaries. The rule sees a connection and nothing of its contents, so it cannot tell C2 topics from telemetry, cannot express the beaconing interval the analytic's TimeWindow knob describes, and misses any broker reached on a port outside the list — the protocol content legs of the strategy need Zeek mqtt.log or xmpp.log, which this log source is not. Requires Sysmon installed with network-connection logging enabled and not trimmed to a short port allowlist; it is absent from a bare Windows install and filtered hard in most shipped configurations, so an empty result means blind, not clean. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0002, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 2 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* (Initiated="true" AND (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\python.exe" OR Image="*\\pythonw.exe" OR Image="*\\node.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe") AND (DestinationPort="1883" OR DestinationPort="8883" OR DestinationPort="5672" OR DestinationPort="5671" OR DestinationPort="5222" OR DestinationPort="5223" OR DestinationPort="61613" OR DestinationPort="61614"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,network_connection,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Initiated" type="pcre2">(?i)^true$</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\python\.exe$|\\pythonw\.exe$|\\node\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$)</field>    <field name="DestinationPort" type="pcre2">(?i)(^1883$|^8883$|^5672$|^5671$|^5222$|^5223$|^61613$|^61614$)</field>    <description>Script host or proxy binary connecting to a message broker port</description>    <mitre>      <id>T1071.005</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. `Initiated` has no Sentinel column: Defender expresses connection direction in `ActionType`, not as a boolean column, so `Initiated` cannot be renamed — it needs a different predicate. The Sigma source is on the first tab, unchanged.

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. `Initiated` has no ECS field: ECS expresses connection direction as `network.direction` with values like `egress`, not as a boolean, so `Initiated` needs a different predicate rather than a rename. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: network_connection / windows
Level: low
Category: reverse_shell
Sigma status: experimental
Backends: 2 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 73b92f04-356b-4bb6-a481-2f78d8ca849b

ATT&CKT1071.005

T1071.005Publish/Subscribe Protocols

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonreverse shell

reverse shellAI draft — unreviewed

01 · What this rule detects

AN0002 describes non-standard processes making outbound publish/subscribe connections to message brokers. This rule reduces its Windows leg to what one Sysmon EventID 3 record can carry: an outbound connection to a broker service port opened by a script host or a signed proxy binary. It sees a connection and nothing of its contents. It cannot read topics, cannot separate C2 from telemetry, and cannot express the beaconing interval MITRE's TimeWindow knob describes. The protocol-content legs of DET0002 need Zeek mqtt.log or xmpp.log, which this log source is not.

02 · Telemetry you need

category: network_connection / product: windows, verbatim from the brief — Sysmon EventID 3. It is absent from a bare Windows install and filtered hard in most shipped Sysmon configs, frequently down to a port allowlist that excludes every port used here. An empty result means blind, not clean.
One deployment caveat the rule's description omits: Initiated: 'true' costs two backends. Sentinel carries direction in ActionType, Elastic in network.direction: egress, and validation records both refusing the field.

03 · How the logic works

A single selection, three fields ANDed. Initiated: 'true' keeps it to outbound sockets. DestinationPort is MITRE's ProtocolPortList knob — MITRE names 1883, 5222 and 5672; the TLS counterparts (8883, 5223, 5671) and the STOMP pair (61613, 61614) are the pipeline's additions. Image|endswith is the UnusualProcessList knob rendered as a fixed ten-entry list: powershell.exe, pwsh.exe, python.exe, pythonw.exe, node.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe. Each opens its own socket, so EventID 3 genuinely names it — the trap where bitsadmin.exe or scp.exe hands the socket to another process does not apply. The list is nonetheless the rule's real weakness. UnusualProcessList is an environment-specific knob; freezing it into a fixed allowlist inverts it, and what gets selected is the noisy half of the population rather than the malicious half. Two concrete misses: version-suffixed interpreters, since side-by-side installs put python3.exe and python3.12.exe on the path and neither ends with \python.exe; and any compiled implant or sideloaded DLL, which opens the socket under its own Image and produces nothing. Pub/sub C2 in the wild is predominantly compiled malware on 8883 — the case the technique exists for, and the case this selection cannot see.

04 · Common false positives

paho-mqtt on an engineering, lab or OT-adjacent workstation is python.exe on 1883 or 8883: exactly the selected tuple, and where such tooling exists it is the highest-volume match by a wide margin. Behind it, CI and back-office automation queueing through RabbitMQ as a scheduled PowerShell task or a node.exe worker; developer machines reaching a local Mosquitto over loopback; and inventory scripts sweeping Test-NetConnection across broker ports, which fires on every host probed.
level: low is deliberate — it was lowered from medium because a rule whose top false positive must be baselined before it is worth alerting on is a hunting surface, not an alert.

05 · Detection maturity

tier_1: , and honestly so. Derived from a MITRE scaffold with no query logic, never executed against a log line, and — unlike most of the corpus — carrying a known structural gap against its own primary threat.
tier_2: run read-only, count by `Image` and `DestinationIp`, and build the broker allowlist that AN0003's `BrokerAllowList` knob names.
tier_3: ** flip to the inversion above and add the beaconing analysis TimeWindow implies, which needs a correlation engine this rule cannot reach.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude loopback first: DestinationIp of 127.0.0.1 and ::1 under a `not
Add \python3.exe at minimum; better, match interpreters by prefix rather than
Baseline by host and destination pair, then invert: the knob as MITRE intends
On Sentinel or Elastic, substitute the direction predicate or drop Initiated

Declared by the author

Python scripts that are genuinely MQTT clients. paho-mqtt talking to a broker on 1883 or 8883 is the ordinary way an engineering, lab or OT-adjacent workstation reads sensor and telemetry topics, and the resulting event is python.exe on a broker port — exactly the tuple selected here. Where such tooling exists this is the highest-volume match by a wide margin and has to be baselined by host and destination before the rule is worth alerting on.
Build and integration jobs that queue work through RabbitMQ. A scheduled PowerShell task or a node.exe worker publishing to 5672 or 5671 is a common shape in CI and back-office automation, and neither the port nor the image distinguishes it from an implant.
Developer machines running a local broker. Mosquitto or RabbitMQ started for testing is reached over loopback by python.exe or node.exe, which still produces an initiated connection on a listed port.
Connectivity checks and scanning scripts. A PowerShell script that sweeps Test-NetConnection across broker ports for inventory or monitoring fires this rule on every host it probes.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1071.005, evaluated against their network_connection events.

Share this rule

/u/siemphony/73b92f04-356b-4bb6-a481-2f78d8ca849b

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Script host or proxy binary connecting to a message broker port

The detection

detection.yml

Splunk · SPL

Wazuh · XML rule

Sentinel · KQL

Elastic · ES|QL

Community

Verdicts from engineers who deployed it