Potentially Suspicious Malware Callback Communication - Linux

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•1•0•30

Detects programs that connect to known malware callback ports based on threat intelligence reports. This rule specifically targets Linux systems and filters out connections to common local IP ranges to reduce false positives.