[Rule modification] Testing Usage of Uncommonly Used Port

[norbert791]

This rule caught my attention, because the title seemed to be referring to the logic too vaguely. After inspecting it a bit more, I've got additional doubts about the rule. Here they are:

• Looking at references and description, primarly the red atomic reference, it seems that the rule should alert on suspicious pairings of protocol + port.
• The rule matches usage of Test-NetConnection which is a network diagnostic tool
• The red atomic uses that tool as an example for this technique, but it's just one of the many ways to execute it.
• Additionally, the Mitre ATT&CK seems to align with the other metadata, but not with the logic.

The way I see it is that the detection should work on a logsource, that allows to inspect protocol and target port. The logic in the detection can be used to detect e.g. outbound port scanning, but that's a whole different detection.

The options are (I believe):

• Deprecate it
• Change metadata to match logic
• Change the logic to match metadata, but that results in essentially new rule (working on new logsource)

---

I am happy to work on this detection to resolve the issue, but I am not sure how it should be handled.

EDIT:
Sorry for not using a template, but I don't think it matches either of them.

[github-actions]

Welcome @norbert791 👋

It looks like this is your first issue on the Sigma rules repository!

The following repository accepts issues related to false positives or rule ideas.

If you're reporting an issue related to the pySigma library please consider submitting it here

Thanks for taking the time to open this issue, and welcome to the Sigma community! 😃

If you want to engage more with the community for official support, general discussions or announcements:

👉 Join our Discord server

[nasbench]

Just want to correct on thing. The way I see it is that the detection should work on a logsource, that allows to inspect protocol and target port is true but in Sigma and in detection in general we write coverage for multiple sources with a variety of accuracy just because not all ingest the same things.

With that said, if you can write a new rule using that logsource and you have data (which i know you have) then please do it.

As far as this old rule, I suggest 2 things.

• Fix it, in the sense deprecate this one but create a new one that has better logic and additional utilities that can be used to do recon on ports via PowerShell, just to keep the coverage form a PowerShell pov alive.
• Deprecate it for now.

[norbert791]

Just want to correct on thing. The way I see it is that the detection should work on a logsource, that allows to inspect protocol and target port is true but in Sigma and in detection in general we write coverage for multiple sources with a variety of accuracy just because not all ingest the same things.

With that said, if you can write a new rule using that logsource and you have data (which i know you have) then please do it.

As far as this old rule, I suggest 2 things.

• Fix it, in the sense deprecate this one but create a new one that has better logic and additional utilities that can be used to do recon on ports via PowerShell, just to keep the coverage form a PowerShell pov alive.
• Deprecate it for now.

Thanks, I'll try to come up with something.