How to defend against command-and-control traffic from hijacked processes

What the attacker does

Attack frameworks often run their agent inside a process that is already on the machine. Two common ways: injecting code into a running process (for example with CreateRemoteThread), or placing a DLL with the name of one that a signed program loads, so the program loads the attacker's code when it starts (DLL hijacking). A related case is a signed .NET tool such as InstallUtil.exe running code from an assembly the attacker supplies. In each case the agent's traffic to its command-and-control server comes from a process with a harmless name.

What it looks like in the logs

A network connection event (Sysmon Event ID 3, category: network_connection): Image is the process that opened the connection, Initiated is true for an outbound connection, and the destination address and port follow. This is one of the connections in the recordings, from a Notepad that a post-exploitation framework had injected into:

What stands out is not the address or the port but that Notepad has a connection at all. In another recording the connecting Notepad ran as NT AUTHORITY\NETWORK SERVICE, which means a service started it; a person opening a text file never does that.

Detect

Measured on the challenge data: the rule caught 20 of 20 attack events and matched 0 of 2,104 normal events.

title: Outbound connection from a Windows program that does not use the network
id: b64fec41-4b83-4bcb-9bf1-986a2c2077a8
status: test
description: >
  Detects an outbound connection opened by a program that has no reason to use the network: the
  System32 and SysWOW64 copies of Notepad, Calculator and Paint, and the .NET tools InstallUtil,
  RegAsm and RegSvcs. Such a connection usually means code was injected into the process or a DLL it
  loads was replaced. The Notepad app from the Microsoft Store is not matched; it has online features.
references:
  - https://attack.mitre.org/techniques/T1055/
  - https://howdefend.com/defend/hijacked-process-c2/
author: Bartu Kılıç
date: 2026-10-21
tags:
  - attack.defense-evasion
  - attack.command-and-control
  - attack.t1055
  - attack.t1574.001
  - attack.t1071.001
logsource:
  product: windows
  category: network_connection
detection:
  selection_outbound:
    Initiated: 'true'
  selection_image:
    Image|endswith:
      - '\System32\notepad.exe'
      - '\SysWOW64\notepad.exe'
      - '\System32\calc.exe'
      - '\SysWOW64\calc.exe'
      - '\System32\mspaint.exe'
      - '\SysWOW64\mspaint.exe'
      - '\InstallUtil.exe'
      - '\RegAsm.exe'
      - '\RegSvcs.exe'
  condition: all of selection_*
falsepositives:
  - A .NET installer that downloads a component while InstallUtil runs it (review the destination)
level: high

What the rule misses

• Hijacked processes that do use the network. Code injected into a browser, Office or svchost.exe sends its traffic among that program's normal connections; the clean Windows 10 client has 1,792 connections from such programs. Detect the injection itself instead: Sysmon Event ID 8 (a thread created in another process) and Event ID 10 (process access), and Event ID 7 for a DLL loaded from a folder its program does not normally load from.
• The Notepad app from the Microsoft Store. On Windows 11, Notepad is installed from the Store, runs from WindowsApps and has online features. The rule names only the System32 and SysWOW64 copies.
• The destination address. Every connection in the recordings goes to 10.10.10.5, the lab's server. That address is an indicator of this one intrusion: useful for searching older logs, useless as the rule for the next one.
• Missing logging. Network connection events are numerous, so many Sysmon configurations filter most of them. Check that the configuration in use keeps connections from these programs.
• A proxy in between. Where workstations reach the internet through a proxy, the Sysmon event shows the proxy's address; the destination is in the proxy's log.

Prevent

• Force traffic through a proxy. Block direct outbound connections from workstations and allow internet access only through a proxy that requires authentication and logs every request. An agent then has to pass a point that records it, and one that does not know the proxy cannot reach its server.
• Enforce App Control for Business. With user mode code integrity enabled, the policy applies to DLLs as well as executables, so a planted DLL that the policy does not allow is not loaded. Microsoft's sample block policy for App Control denies InstallUtil.exe.
• Fewer administrators. Injecting into another user's process or a service, and placing DLLs in protected folders, need administrator rights.

Practice

Write the rule yourself on the same data, with every target labelled.

Sources

• MITRE ATT&CK: T1055 Process Injection
• MITRE ATT&CK: T1574.001 DLL Search Order Hijacking
• Microsoft Learn: Applications that can bypass App Control and how to block them
• OTRF Security-Datasets (attack recordings used on this page)