BambooToken Malware Uses MQTT for Cross-Platform C2 on Windows and Linux — Detection and Threat Hunting Guide

---
title: Outbound MQTT Connection from Non-Standard Process
description: Detects processes outside an approved MQTT client list initiating connections to MQTT broker ports (1883/8883). BambooToken uses MQTT for C2 on Windows and Linux; legitimate MQTT should be confined to known IoT/agent binaries.
references:
  - https://www.bleepingcomputer.com/news/security/bambootoken-malware-controls-windows-and-linux-systems-via-mqtt/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection_ports:
    DestinationPort:
      - 1883
      - 8883
  filter_approved:
    Image|endswith:
      - '\mosquitto.exe'
      - '\mosquitto_pub.exe'
      - '\mosquitto_sub.exe'
      - '\emqx.exe'
      - '\iotedge.exe'
  condition: selection_ports and not filter_approved
falsepositives:
  - Approved IoT gateway software or custom telemetry agents — build an environment-specific allowlist of broker destinations and client binaries before enabling at high level
level: high
---
title: Linux Outbound MQTT Connection from Suspicious Path
description: Detects processes executing from world-writable or user-level paths on Linux initiating MQTT broker connections. BambooToken implants on Linux are staged from /tmp, /var/tmp, /dev/shm, or hidden user directories.
references:
  - https://www.bleepingcomputer.com/news/security/bambootoken-malware-controls-windows-and-linux-systems-via-mqtt/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1036
logsource:
  category: network_connection
  product: linux
detection:
  selection_ports:
    DestinationPort:
      - 1883
      - 8883
  selection_paths:
    Image|startswith:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - '/home/'
      - '/run/user/'
  condition: selection_ports and selection_paths
falsepositives:
  - Developers running ad-hoc MQTT test clients from home directories — validate against change records
level: high
---
title: MQTT Client Utility Execution on Endpoint
description: Detects execution of standalone MQTT publish/subscribe utilities on systems where no IoT messaging role exists. Operators or staging scripts may invoke these to test broker reachability before implant deployment.
references:
  - https://www.bleepingcomputer.com/news/security/bambootoken-malware-controls-windows-and-linux-systems-via-mqtt/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
product: windows
detection:
  selection:
    - Image|endswith:
        - '\mosquitto_pub.exe'
        - '\mosquitto_sub.exe'
        - '\mqtt.exe'
        - '\mqttx.exe'
    - CommandLine|contains:
        - 'mosquitto_pub'
        - 'mosquitto_sub'
        - 'mqtt pub'
        - 'mqtt sub'
falsepositives:
  - IoT development and QA workstations — scope to server and general-user populations
level: medium

let MQTTPorts = dynamic([1883, 8883]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort in (MQTTPorts)
| where ActionType == "ConnectionSuccess"
| extend ProcessPath = tostring(InitiatingProcessFolderPath)
| summarize Connections = count(),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            RemoteIPs = make_set(RemoteIP, 20),
            RemoteUrls = make_set(RemoteUrl, 20)
  by DeviceName, InitiatingProcessFileName, ProcessPath, InitiatingProcessCommandLine, RemotePort
| where Connections >= 2
| order by FirstSeen asc;

// Correlate with process lineage to find the implant's parent/stager
let MQTTPorts = dynamic([1883, 8883]);
let mqtt_hosts = DeviceNetworkEvents
  | where TimeGenerated > ago(7d) and RemotePort in (MQTTPorts)
  | summarize by DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256;
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where SHA256 in (mqtt_hosts | project InitiatingProcessSHA256)
   or ProcessCommandLine has_any ("1883", "8883", "mqtt", "subscribe", "publish")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessParentFileName, AccountName, SHA256
| order by TimeGenerated asc;

// Syslog/CEF path for Linux estates forwarding to Sentinel
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("1883", "8883", "mqtt")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

-- BambooToken triage: MQTT connections, owning processes, and persistence sweep
LET conns = SELECT Pid, Name, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE RemotePort in (1883, 8883)

SELECT c.Pid AS Pid,
       c.Name AS ConnName,
       c.RemoteAddress AS BrokerIP,
       c.RemotePort AS BrokerPort,
       c.Status AS ConnStatus,
       p.Exe AS ProcessPath,
       p.CommandLine AS CommandLine,
       p.Username AS Username,
       p.CreateTime AS ProcessStart
FROM conns AS c
JOIN pslist() AS p ON c.Pid = p.Pid

-- Linux persistence sweep: systemd units and cron entries referencing user-writable paths
SELECT FullPath, Mtime, Size,
       read_file(filename=FullPath) AS Content
FROM glob(globs=['/etc/systemd/system/*.service',
                 '/etc/systemd/user/*.service',
                 '/etc/cron.d/*',
                 '/var/spool/cron/*',
                 '/home/*/.config/systemd/user/*.service'])
WHERE Content =~ '/tmp/|/var/tmp|/dev/shm|/home/'
   OR Content =~ '1883|8883|mqtt'

# BambooToken containment - Windows endpoint egress control for MQTT
# Run elevated. Blocks outbound MQTT except from approved broker IPs.

$ApprovedBrokers = @("10.10.5.20", "10.10.5.21")  # Replace with sanctioned broker IPs

# Audit first: log current outbound MQTT attempts
New-NetFirewallRule -DisplayName "MQTT-Egress-Audit-1883" -Direction Outbound `
  -Protocol TCP -RemotePort 1883 -Action Allow -Profile Any -Enabled True | Out-Null
New-NetFirewallRule -DisplayName "MQTT-Egress-Audit-8883" -Direction Outbound `
  -Protocol TCP -RemotePort 8883 -Action Allow -Profile Any -Enabled True | Out-Null

# Allow approved brokers, then default-deny the rest
New-NetFirewallRule -DisplayName "MQTT-Allow-Approved-1883" -Direction Outbound `
  -Protocol TCP -RemotePort 1883 -RemoteAddress $ApprovedBrokers -Action Allow | Out-Null
New-NetFirewallRule -DisplayName "MQTT-Allow-Approved-8883" -Direction Outbound `
  -Protocol TCP -RemotePort 8883 -RemoteAddress $ApprovedBrokers -Action Allow | Out-Null
New-NetFirewallRule -DisplayName "MQTT-Block-Default-1883" -Direction Outbound `
  -Protocol TCP -RemotePort 1883 -Action Block | Out-Null
New-NetFirewallRule -DisplayName "MQTT-Block-Default-8883" -Direction Outbound `
  -Protocol TCP -RemotePort 8883 -Action Block | Out-Null

# Hunt: any local process with an established MQTT connection right now
Get-NetTCPConnection -State Established |
  Where-Object { $_.RemotePort -in 1883,8883 } |
  ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{
      RemoteIP   = $_.RemoteAddress
      RemotePort = $_.RemotePort
      Process    = $proc.ProcessName
      Path       = $proc.Path
      PID        = $_.OwningProcess
    }
  } | Format-Table -AutoSize

# BambooToken containment - Linux egress control + live MQTT connection audit
# Run as root. Default-deny MQTT egress except approved brokers.

APPROVED_BROKERS="10.10.5.20 10.10.5.21"   # Replace with sanctioned broker IPs

# Allow approved brokers
for broker in $APPROVED_BROKERS; do
  iptables -A OUTPUT -p tcp -d "$broker" --dport 1883 -j ACCEPT
  iptables -A OUTPUT -p tcp -d "$broker" --dport 8883 -j ACCEPT
done

# Log and drop all other MQTT egress (logs feed your SIEM via syslog)
iptables -A OUTPUT -p tcp --dport 1883 -j LOG --log-prefix "MQTT-EGRESS-BLOCK: "
iptables -A OUTPUT -p tcp --dport 8883 -j LOG --log-prefix "MQTT-EGRESS-BLOCK: "
iptables -A OUTPUT -p tcp --dport 1883 -j DROP
iptables -A OUTPUT -p tcp --dport 8883 -j DROP

# Audit: identify any process currently holding an MQTT connection
echo "=== Established MQTT connections ==="
ss -tnp state established '( dport = :1883 or dport = :8883 )'

# Audit: binaries with MQTT client libraries linked (quick implant surface check)
echo "=== Processes referencing MQTT libraries ==="
for pid in $(ls /proc | grep -E '^[0-9]+$'); do
  grep -qs "mqtt\|mosquitto\|paho" /proc/$pid/maps 2>/dev/null && \
    echo "PID $pid: $(readlink /proc/$pid/exe 2>/dev/null)"
done

# Audit: persistence locations referencing suspicious paths or MQTT
grep -rlsE "/tmp/|/var/tmp|/dev/shm|1883|8883|mqtt" \
  /etc/systemd/system/ /etc/cron.d/ /var/spool/cron/ 2>/dev/null