Sunturai
Back to results
InformationalSplunk security contentNasreddine Bencherchali +1

Cisco NVM - Outbound Connection to Suspicious Port

The following analytic detects any outbound network connection from an endpoint process to a known suspicious or non-standard port. It leverages Cisco Network Visibility Module flow data logs to identify potentially…

Description

The following analytic detects any outbound network connection from an endpoint process to a known suspicious or non-standard port. It leverages Cisco Network Visibility Module flow data logs to identify potentially suspicious behavior by looking at processes communicating over ports like 4444, 2222, or 51820 are commonly used by tools like Metasploit, SliverC2 or other pentest, red team or malware. These connections are worth investigating further, especially when initiated by unexpected or non-network-native binaries.

Detection logic

Detection requirements

Platform
ESXiLinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
cisco_network_visibility_module_flow_data

Known benign triggers

  • Some legitimate applications may use high or non-standard ports, such as alternate SSH daemons or development tools. However, many of these ports are commonly used by threat actors for reverse shells or C2 communications. Review the associated process and command-line context to determine intent.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice