Loading story…
Splunk released an anomaly detection for Windows Living Off the Land Binaries and Scripts (LOLBAS) establishing public network connections on destination ports that are unusual for the originating process. Such activity can indicate command-and-control communications, payload transfer, proxy execution, or defense evasion using legitimate Windows utilities.
The analytic queries the Splunk Network Traffic data model, excludes private and reserved destination ranges, and applies binary-specific expected-port exclusions to limit false positives. It requires normalized network telemetry—such as Sysmon Event ID 3—is disabled by default, and generates intermediate risk events rather than direct notable events, enabling SOC teams to correlate suspicious LOLBAS traffic with ATT&CK-tracked adversary behavior.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Splunk updated its "LOLBAS Network Connection On Uncommon Port" anomaly detection for Splunk Enterprise Security. The analytic identifies Windows LOLBAS processes making public network connections over ports atypical for the process and generates intermediate risk events.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk has removed its deprecated **"Network Connection Discovery With Net"** analytic and replaced it with **"Windows Network Connection Discovery Via Net"**, updating the detection logic for suspicious use of `net.exe` and `net1.exe` on Windows systems. The analytic is designed to surface command-line activity associated with **MITRE ATT&CK `T1049`**, which covers adversary reconnaissance of active network connections, open ports, sessions, and reachable resources after initial compromise. MITRE documents `T1049` as a common post-compromise behavior used by APT groups, ransomware operators, and malware families to map local network connectivity through utilities such as `netstat`, `net use`, and `net session`, as well as Windows networking APIs. Splunk said the detection relies on telemetry including **Sysmon Event ID 1**, **Windows Security Event ID 4688**, and **CrowdStrike ProcessRollup2** normalized into the Splunk Endpoint data model, and noted that while the activity can indicate reconnaissance supporting lateral movement or data exfiltration, administrators may also trigger it during legitimate troubleshooting.
Aug 12, 2026
Splunk published a new analytic to detect Linux reverse shells that abuse shell pseudo-devices such as `/dev/tcp` and `/dev/udp` to open outbound connections from `bash`, `sh`, `dash`, or `zsh` without requiring tools like `netcat`. The detection, **Linux Shell Pseudo Device Reverse Shell**, is designed for Splunk Enterprise Security and uses EDR or Sysmon for Linux process telemetry mapped into the CIM Endpoint Processes data model to identify shell redirection patterns commonly used after compromise for remote access and command execution. The analytic is mapped to MITRE ATT&CK techniques **`T1048.003`** and **`T1059`**, linking the behavior to exfiltration over unencrypted non-C2 protocols and command-shell abuse. MITRE documents broad adversary use of alternative outbound protocols—including HTTP, FTP, SMTP, DNS, WebDAV, TCP, and TFTP—for data theft and covert transfer, as well as the use of legitimate utilities such as `curl`, `ftp`, WinSCP, and Rclone. Splunk said the detection generates intermediate risk events by default and warned that legitimate administrative diagnostics or testing can also trigger it, making environment-specific filtering important.
Aug 12, 2026
Splunk released an Enterprise Security analytic to detect `socat` processes that pair `exec:` with `-listen:` arguments, a pattern that can bind an executable to inbound TCP or OpenSSL connections. The resulting listener can provide a bind shell, remote command execution, lateral movement, or command-and-control (C2) tunneling. The detection generates notable findings and risk events from endpoint process telemetry; defenders should tune it for legitimate development, debugging, protocol testing, and network-troubleshooting activity. Protocol tunneling remains a widely used ATT&CK technique (`T1572`) for concealing C2 within common services and protocols, including SSH, DNS/DoH, HTTP CONNECT, SOCKS, TLS, and reverse-tunnel platforms such as ngrok. Recent investigations illustrate the risk: REF0657 used iox, Rakshasa, and ICMP tunneling during a financial-services intrusion, while SOMNIRECORD disguised C2 and exfiltration as DNS TXT queries. Elastic also observed suspicious macOS activity in which a coding agent preceded Cloudflare Quick Tunnel use, an ngrok alert, and LaunchAgent persistence, underscoring the need to investigate tunnel creation and persistence even when trusted developer tools initiate them.
Sep 10, 2026