Suspicious Wordpad Outbound Connections

Hunt Hypothesis

The hypothesis detects potential

Detection Rule

Sigma (Original)

title: Suspicious Wordpad Outbound Connections
id: 786cdae8-fefb-4eb2-9227-04e34060db01
status: test
description: |
    Detects a network connection initiated by "wordpad.exe" over uncommon destination ports.
    This might indicate potential process injection activity from a beacon or similar mechanisms.
references:
    - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
author: X__Junior (Nextron Systems)
date: 2023-07-12
modified: 2023-12-15
tags:
    - attack.command-and-control
    - attack.stealth
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        Image|endswith: '\wordpad.exe'
    filter_main_ports:
        DestinationPort:
            - 80
            - 139
            - 443
            - 445
            - 465
            - 587
            - 993
            - 995
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Other ports can be used, apply additional filters accordingly
level: medium

KQL (Azure Sentinel)

imNetworkSession
| where (NetworkDirection =~ "true" and (SrcProcessName endswith "\\wordpad.exe" or DstProcessName endswith "\\wordpad.exe")) and (not((DstPortNumber in~ ("80", "139", "443", "445", "465", "587", "993", "995"))))

Required Data Sources

False Positive Guidance

• Other ports can be used, apply additional filters accordingly

MITRE ATT&CK Context

• Tactic: Command and Control

References

• https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
• SigmaHQ Rule