Sigma rule: UNC4841 - SSL Certificate Exfiltration Via Openssl

Rule

Title

UNC4841 - SSL Certificate Exfiltration Via Openssl

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-06-16

File

rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_openssl_connection.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of "openssl" to connect to an IP address. This techniques was used by UNC4841 to exfiltrate SSL certificates and as a C2 channel with named pipes. Investigate commands executed in the temporal vicinity of this command.

Log source

product

linux

category

process_creation

Detection

selection:
    Image|endswith: '/openssl'
    CommandLine|re: '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
    CommandLine|contains|all:
        - 's_client'
        - '-quiet'
        - '-connect'
    CommandLine|contains:
        - ':443'
        - ':8080'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1140
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1140

References

• https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_openssl_connection.yml