このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Goal
Detect when an egress connection is made over port 6667 (IRC).
Strategy
Egress connections to unknown hosts over port 6667 should be rare. Internet Relay Chat (IRC) is a protocol that is commonly abused by malicious botnet operators. Malicious commands built into the malware include methods to fetch system information, download additional malware, or execute attacks targeting other hosts.
Triage and response
- Determine the process making the connection.
- Verify if there is a legitimate reason for the host to communicate over this port. Search network flows to determine whether the activity is happening on other hosts.
- Isolate the workload, preserving it for analysis.
- Review related signals to understand the full timeline of the incident.
- Find and repair the root cause of the incident.
This detection is based on data from Network Performance Monitoring.
