Detectionmediumtest
Network Connection Initiated To BTunnels Domains
Detects network connections to BTunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsNetwork Connection
ProductWindows← raw: windows
CategoryNetwork Connection← raw: network_connection
Events for outbound and inbound network connections including DNS resolution.
Detection Logic
Detection Logic1 selector
detection:
selection:
Initiated: 'true'
DestinationHostname|endswith: '.btunnel.co.in'
condition: selectionFalse Positives
Legitimate use of BTunnels will also trigger this.
References
MITRE ATT&CK
Rule Metadata
Rule ID
9e02c8ec-02b9-43e8-81eb-34a475ba7965
Status
test
Level
medium
Type
Detection
Created
Fri Sep 13
Author
Path
rules/windows/network_connection/net_connection_win_domain_btunnels.yml
Raw Tags
attack.exfiltrationattack.command-and-controlattack.t1567attack.t1572