UNC4841 - SSL Certificate Exfiltration Via Openssl
Detects the execution of 'openssl' with specific command-line arguments to connect to an IP address on ports 443 or 8080. This activity has been observed in campaigns by UNC4841 for SSL certificate exfiltration and as a C2 channel using named pipes. Further investigation of commands executed in the temporal vicinity of this activity is recommended.
Sigma
