Raw socket tool invoked against a classic IRC port

Siemphony@siemphonymediumT1071unverified

Matches nc, ncat, socat or telnet started with a well-known IRC port argument on Linux — the residual slice of AN1226's "IRC-style protocols" that none of the technique's published children own. HTTP/HTTPS belongs to Web Protocols (T1071.001), DNS to T1071.004, and mail ports to T1071.003, already published in this corpus; IRC has no numbered child at all, so this is the one piece of the parent's own brief that is not just a duplicate of a sibling under a different name. AN1225's Windows leg is deliberately not used: it names SMB alongside HTTP/DNS, and Sysmon EventID 3 attributes port 445 connections to System because the SMB client redirector runs in kernel mode, not to whatever process queued the transfer — an Image-gated selection on that port would look like coverage and match nothing, the exact trap the sibling T1071.002 rule in this corpus already documents. Bare nc is included alongside ncat and socat, unlike the T1090 rule in this corpus, which drops it because Debian and Ubuntu route it through update-alternatives to nc.openbsd or nc.traditional; both alternate names are listed here for that reason. The port list is authored for this rule, not MITRE's — the brief's KnownPortsToMonitor knob gives HTTPS and DNS examples (8443, 5353) but names no IRC port. Requires an explicit -a always,exit -F arch=b64 -S execve auditd rule; auditd ships none by default, and CommandLine here depends on this corpus's pipeline joining the SYSCALL and EXECVE records, since a raw auditd feed keeps argv separate. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0444, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "/nc" or FolderPath endswith "/nc.openbsd" or FolderPath endswith "/nc.traditional" or FolderPath endswith "/ncat" or FolderPath endswith "/socat" or FolderPath endswith "/telnet") and (ProcessCommandLine contains "6667" or ProcessCommandLine contains "6668" or ProcessCommandLine contains "6669" or ProcessCommandLine contains "6697"))

Splunk · SPL

Run this as a search.

index=* ((Image="*/nc" OR Image="*/nc.openbsd" OR Image="*/nc.traditional" OR Image="*/ncat" OR Image="*/socat" OR Image="*/telnet") AND (CommandLine="*6667*" OR CommandLine="*6668*" OR CommandLine="*6669*" OR CommandLine="*6697*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*/nc" OR TO_LOWER(process.executable) LIKE "*/nc.openbsd" OR TO_LOWER(process.executable) LIKE "*/nc.traditional" OR TO_LOWER(process.executable) LIKE "*/ncat" OR TO_LOWER(process.executable) LIKE "*/socat" OR TO_LOWER(process.executable) LIKE "*/telnet") AND (TO_LOWER(process.command_line) LIKE "*6667*" OR TO_LOWER(process.command_line) LIKE "*6668*" OR TO_LOWER(process.command_line) LIKE "*6669*" OR TO_LOWER(process.command_line) LIKE "*6697*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/nc$|/nc\.openbsd$|/nc\.traditional$|/ncat$|/socat$|/telnet$)</field>    <field name="CommandLine" type="pcre2">(?i)(6667|6668|6669|6697)</field>    <description>Raw socket tool invoked against a classic IRC port</description>    <mitre>      <id>T1071</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: medium
Category: reverse_shell
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: b57b0be3-fa3d-4694-a055-06e9b184f328

ATT&CKT1071

T1071Application Layer Protocol

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonreverse shell

reverse shellAI draft — unreviewed

01 · What this rule detects

This rule catches one narrow slice of T1071: a raw socket tool — nc, its Debian/Ubuntu-renamed siblings nc.openbsd and nc.traditional, ncat, socat, or telnet — invoked on Linux with a command line containing a classic IRC port (6667, 6668, 6669, 6697). It exists because AN1226's "IRC-style protocols" clause is the one part of the parent technique's own analytic that isn't already owned by a numbered child: HTTP/HTTPS is T1071.001, DNS is T1071.004, mail ports are T1071.003. IRC C2 channels, unusually, have no dedicated sub-technique, so this rule fills that specific gap instead of duplicating a sibling.

02 · Telemetry you need

The logsource is category: process_creation, product: linux, sourced from auditd's SYSCALL::execve records per the brief. Two things must already be true for this rule to see anything: an explicit -a always,exit -F arch=b64 -S execve rule loaded into auditd, since stock auditd ships with process-creation auditing off; and a pipeline step that joins each SYSCALL record to its paired EXECVE record, because raw auditd keeps argv as separate a0/a1/a2... fields rather than a single CommandLine string. Without both, Image and CommandLine are empty and the rule is blind, not quiet.

03 · How the logic works

Two selections, ANDed. selection_tool matches Image|endswith against six binary names — nc.openbsd and nc.traditional are included because Debian/Ubuntu route bare nc through update-alternatives to one of those two, so filtering on plain nc alone would miss most distro installs. selection_port matches CommandLine|contains against the four IRC port strings. condition: selection_tool and selection_port fires only when a recognized tool and one of those port substrings both appear in the same event — it says nothing about payload, timing, or whether an IRC handshake ever completed, only that the invocation looks like one.

04 · Common false positives

review.json flags the sharpest limitation: CommandLine|contains has no word boundary, and this logsource carries no structured destination-port field the way the Windows network_connection rules elsewhere in this corpus do. So selection_port is a bare substring test against free-form argv text — a PID, a timestamp, or a larger port like 56667 satisfies it just as well as an actual --port 6667 would. That is a real precision gap, not a hedge. On top of that: ops teams piping Nagios/Icinga alerts into IRC via nc-based bots, telnet used purely as a port-reachability check, and red-team C2 emulation labs standing up IRC channels on purpose. A fourth candidate — wide port-range scanners — is narrower than it first sounds: nc/ncat accept native range syntax like 6660-6670 as one argument, which never contains the literal substring "6667", so only scanners that loop and invoke the tool once per port actually match.

05 · Detection maturity

tier_1: This rule is UNVERIFIED — the lowest DeBMM tier. It was authored from MITRE's prose scaffold and has never been run against a single real log line, so there is no hit count, no false-positive rate, and no baseline to cite; any such number would be fabricated. Before relying on it operationally, load it against real auditd output with the SYSCALL/EXECVE join in place and validate every finding above by hand.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

The brief's KnownPortsToMonitor knob (AN1226) tells the author to watch uncommon ports for HTTPS/IRC/DNS, offering 8443 and 5353 as MITRE's own examples — it names no IRC port at all. The 6667/6668/6669/6697 list here is authored for this rule, not MITRE's; treat it as a first guess, not a citation. To tighten selection_port, replace the bare contains with a CommandLine|re anchored on word boundaries so a PID or larger port number can't collide. AN1226 also names BeaconTimingThreshold — detecting regular outbound intervals — but that is a windowed/aggregation concept lib/sigma in this corpus cannot express. Like the rest of the corpus, this rule only covers the precursor process-creation event, not beacon behavior over time; a SIEM's aggregation layer would be needed to close that gap.

Declared by the author

Ops teams running a legacy IRC-based alerting bot (a common pattern for piping Nagios or Icinga alerts into a channel) that connects with nc or a small wrapper script on a fixed schedule from a small set of hosts.
Network engineers or monitoring tooling using telnet purely as a generic port-connectivity check against 6667 or 6697 to verify a firewall rule or that an IRC bouncer is listening, with no IRC session ever established.
Security testing and red-team C2 emulation frameworks deliberately standing up or connecting to an IRC-based C2 channel in a lab environment as part of a detection-validation exercise.
General-purpose port scanners invoked through nc or ncat across a wide port range for host discovery, which will include 6667-6669 and 6697 incidentally on any scan wide enough to cover them.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1071, evaluated against their process_creation events.

Share this rule

/u/siemphony/b57b0be3-fa3d-4694-a055-06e9b184f328

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Raw socket tool invoked against a classic IRC port

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it