Application Layer Protocol `T1071`

Tactic: Command & Control

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Events covered

47 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 3	Network connection
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Sysmon	Event ID 15	FileCreateStreamHash
Sysmon	Event ID 17	PipeEvent (Pipe Created)
Sysmon	Event ID 18	PipeEvent (Pipe Connected)
Sysmon	Event ID 22	DNSEvent (DNS query)
Sysmon	Event ID 23	FileDelete (File Delete archived)
Sysmon	Event ID 26	FileDeleteDetected (File Delete logged)
Security-Auditing	Event ID 4662	An operation was performed on an object.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4698	A scheduled task was created.
Security-Auditing	Event ID 5136	A directory service object was modified.
Security-Auditing	Event ID 5137	A directory service object was created.
Security-Auditing	Event ID 5152	The Windows Filtering Platform blocked a packet.
Security-Auditing	Event ID 5154	The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
Security-Auditing	Event ID 5155	The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
Security-Auditing	Event ID 5156	The Windows Filtering Platform has permitted a connection.
Security-Auditing	Event ID 5157	The Windows Filtering Platform has blocked a connection.
Security-Auditing	Event ID 5158	The Windows Filtering Platform has permitted a bind to a local port.
Security-Auditing	Event ID 5159	The Windows Filtering Platform has blocked a bind to a local port.
Defender-CloudAppEvents	any	Cloud app activity
Defender-DeviceEvents	any	Defender event
Defender-DeviceFileEvents	any	File activity
Defender-DeviceImageLoadEvents	any	Image load
Defender-DeviceNetworkEvents	any	Network activity
Defender-DeviceNetworkEvents	InboundConnectionAccepted	Inbound connection accepted
Defender-EmailEvents	any	Email processed
Defender-EmailUrlInfo	any	Email URL observed
Defender-UrlClickEvents	any	URL click activity
ESF	exec	Process Execution
ESF	write	File Write
AppLocker	Event ID 8002	FilePathBuffer was allowed to run.
AppLocker	Event ID 8003	RuleAndFileData.FilePath was allowed to run but would have been prevented from running if the AppLocker policy were enforced.
AppLocker	Event ID 8005	FilePathBuffer was allowed to run.
DNS-Client	Event ID 3008	DNS query is completed for the name QueryName, type QueryType, query options QueryOptions with status QueryStatus Results QueryResults.
DNSServer	Event ID 257	RESPONSE_SUCCESS: TCP=TCP; InterfaceIP=InterfaceIP; Destination=Destination; AA=AA; AD=AD; QNAME=QNAME; QTYPE=QTYPE; XID=XID; DNSSEC=DNSSEC; RCODE=RCODE; Port=Port; Flags=Flags; Scop...
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 800	Event ID 800
Service-Control-Manager	Event ID 7045	A service was installed in the system.
Sysmon-for-Linux	Event ID 1	Process Create

Authoring guide

These 506 rules share fields, values, and exclusions.

Fields filtered most (370 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	159	`eq` 139, `in` 31, `ne` 1	`exec`, `connection_attempted`, `start`, `connection_accepted`, `lookup_result`
`process_name`	139	`in` 68, `eq` 62, `starts_with` 27, `wildcard` 24, `is_not_null` 6, `ends_with` 3, `regex_match` 3, `contains` 2, `ne` 1	`bash`, `csh`, `busybox`, `dash`, `curl`
`event.type`	131	`eq` 131	`start`, `creation`, `change`, `connection`, `deletion`
`Image`	70	`starts_with` 26, `ends_with` 22, `wildcard` 22, `eq` 6, `contains` 4, `is_not_null` 2, `in` 1	`/dev/shm/`, `./`, `./`, `/boot/`, `/boot/`
`process.args`	64	`eq` 32, `in` 23, `starts_with` 17, `wildcard` 16, `contains` 9, `regex_match` 5, `ends_with` 3	`-c`, `-cl`, `-e`, `-i`, `-lc`
`CommandLine`	63	`contains` 40, `wildcard` 23, `regex_match` 18, `ends_with` 3, `is_not_null` 2, `length_compare` 1, `match` 1	`/dev/shm/`, `/dev/tcp`, `(?i)ftp\s+(.{1,})?\-s\:.{1,}\.\w{2,5}`, `* setsid *`, `--user-agent`
`host.os.type`	63	`eq` 62, `in` 2
`Active`	51	`eq` 51	`true`
`parent_process_name`	49	`eq` 30, `in` 18, `starts_with` 12, `wildcard` 9, `ends_with` 2	`bash`, `csh`, `apache2`, `dash`, `.`
`ValidUntil`	47	`is_null` 47, `time_range` 47
`IndicatorType`	45	`eq` 24, `in` 21	`ipv4-addr`, `network-traffic`, `ipv6-addr`, `domain-name`, `url`
`QueryName`	45	`ends_with` 12, `is_not_null` 12, `wildcard` 10, `contains` 9, `starts_with` 4, `eq` 2, `in` 2, `ne` 2, `regex_match` 2	`.aternos.me`, `.geojs.io`, `.000webhostapp.com`, `.afraid.org`, `*.4shared.com`
`EventID`	32	`eq` 25, `in` 5, `regex_match` 2	`3`, `1`, `22`, `17`, `18`
`ParentImage`	28	`starts_with` 10, `wildcard` 8, `ends_with` 5, `is_not_null` 4, `contains` 1, `in` 1	`./`, `/boot/`, `/dev/shm/`, `/bin/java`, `/bin/node`
`NetworkSourceIP`	23	`is_not_null` 23

Top indicator values (4853 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticApple Script Execution followed by Network Connection elasticAt Utility Launched through Udevadm elasticBackground Task Execution via a Hidden Process elasticBind Shell via Netcat Traditional elasticBind Shell via Node elasticBind Shell via Socket elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticCurl or Wget Spawned via Node.js elasticCurl to Telegram API elasticDNS Request by Suspicious Process Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory +112 more rules	127	1078
`EventType`	`eq`	`exec` sigmamacOS DNS Query Tools for C2 sigmamacOS HTTP Tools with Protocol Indicators sigmamacOS Network Utility Tools for C2 elasticAt Utility Launched through Udevadm elasticBackground Task Execution via a Hidden Process elasticBind Shell via Netcat Traditional elasticBind Shell via Node elasticBind Shell via Socket elasticCommand Interpreter with IP Address Argument elasticCurl to Telegram API elasticDNS Request by Suspicious Process Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory +78 more rules	93	576
`EventType`	`eq`	`connection_attempted` elasticCommand Interpreter with IP Address Argument elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGenAI Process Connection to Unusual Domain elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell via setsid and nohup elasticLinux Reverse Shell via Suspicious Utility elasticLinux Reverse Shell via Xterm +22 more rules	37	73
`EventType`	`eq`	`start` elasticConnection to Dynamic DNS Provider by a Signed Binary Proxy elasticConnection to Dynamic DNS Provider by an Unsigned Binary elasticConnection to WebService by a Signed Binary Proxy elasticConnection to WebService by an Unsigned Binary elasticDNS Over HTTPS by an Unusual Process elasticDNS Query to Suspicious Top Level Domain elasticJava Dropped and Executed With DNS Lookup elasticPossible JAVA Reverse Shell elasticPotential Command and Control via Windows Scripts elasticPotential Reverse Shell via Java elasticScripting or Unsigned Binary Performing DNS Lookups to Ethereum RPC Providers elasticSuspicious Command and Control via Internet Explorer elasticSuspicious Communication via Mail Protocol elasticSuspicious DNS Query from Mounted Virtual Disk elasticSuspicious Execution from a Windows Script +1 more rules	16	391
`Active`	`eq`	`true` kustoGreyNoise TI Map IP Entity to CommonSecurityLog kustoGreyNoise TI Map IP Entity to DnsEvents kustoGreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema) kustoGreyNoise TI map IP entity to OfficeActivity kustoGreyNoise TI Map IP Entity to SigninLogs kustoPreview - TI map Domain entity to Cloud App Events kustoPreview - TI map IP entity to Cloud App Events kustoPreview - TI map URL entity to Cloud App Events kustoThreat Connect TI map Domain entity to DnsEvents kustoThreatConnect TI map Email entity to OfficeActivity kustoThreatConnect TI map Email entity to SigninLogs kustoThreatConnect TI map IP entity to Network Session Events (ASIM Network Session schema) kustoThreatConnect TI Map URL Entity to OfficeActivity Data kustoTI Map Domain Entity to DeviceNetworkEvents kustoTI map Domain entity to Dns Events (ASIM DNS Schema) +36 more rules	51	70
`process_name`	`in`	`bash` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Hook Egress Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via setsid and nohup elasticLinux Suspicious Child Process Execution via Interactive Shell elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server +26 more rules	41	202
`process_name`	`in`	`sh` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Hook Egress Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via setsid and nohup elasticLinux Suspicious Child Process Execution via Interactive Shell elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server +26 more rules	41	197
`process_name`	`in`	`zsh` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Hook Egress Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via setsid and nohup elasticLinux Suspicious Child Process Execution via Interactive Shell elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server +26 more rules	41	196
`process_name`	`in`	`dash` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Hook Egress Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via setsid and nohup elasticLinux Suspicious Child Process Execution via Interactive Shell elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server +24 more rules	39	170
`process_name`	`in`	`csh` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Hook Egress Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via setsid and nohup elasticLinux Suspicious Child Process Execution via Interactive Shell elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server +23 more rules	38	159
`process_name`	`in`	`fish` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Hook Egress Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via setsid and nohup elasticLinux Suspicious Child Process Execution via Interactive Shell elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server +23 more rules	38	163
`process_name`	`in`	`ksh` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Hook Egress Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via setsid and nohup elasticLinux Suspicious Child Process Execution via Interactive Shell elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server +23 more rules	38	163
`process_name`	`in`	`tcsh` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Hook Egress Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via setsid and nohup elasticLinux Suspicious Child Process Execution via Interactive Shell elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server +23 more rules	38	156
`process_name`	`in`	`curl` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticCurl to Telegram API elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Repository or File Download to Suspicious Directory elasticLinux Telegram API Request elasticPayload Execution via Shell Pipe Detected by Defend for Containers elasticPotential Remote Code Execution via Database Server elasticPotential Remote Code Execution via Mail Server elasticRecently Downloaded File Made Executable and Run +7 more rules	22	89
`process_name`	`in`	`wget` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Repository or File Download to Suspicious Directory elasticLinux Telegram API Request elasticPayload Execution via Shell Pipe Detected by Defend for Containers elasticPotential Remote Code Execution via Database Server elasticPotential Remote Code Execution via Mail Server elasticRecently Downloaded File Made Executable and Run elasticScript DNS Query to Managed Kubernetes Cluster +4 more rules	19	46
`process_name`	`in`	`busybox` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server elasticPayload Execution by Web Server elasticPotential Remote Code Execution via Database Server elasticPotential Remote Code Execution via Mail Server elasticPotential Reverse Shell Activity via TCP/UDP Socket elasticScript DNS Query to Managed Kubernetes Cluster elasticSuspicious Echo Execution elasticUnusual Command Execution via Cron +3 more rules	18	68
`IndicatorType`	`in`	`ipv4-addr` kustoGSA - TI IP Entity kustoTI Map IP entity to AppServiceHTTPLogs kustoTI Map IP entity to AWSCloudTrail kustoTI Map IP entity to Azure Key Vault logs kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to AzureActivity kustoTI Map IP entity to AzureFirewall kustoTI Map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI Map IP entity to Cloud App Events kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to DeviceNetworkEvents kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to Duo Security kustoTI Map IP entity to GitHub_CL kustoTI Map IP entity to Network Session Events (ASIM Network Session schema) +6 more rules	21	21
`IndicatorType`	`in`	`network-traffic` kustoGSA - TI IP Entity kustoTI Map IP entity to AppServiceHTTPLogs kustoTI Map IP entity to AWSCloudTrail kustoTI Map IP entity to Azure Key Vault logs kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to AzureActivity kustoTI Map IP entity to AzureFirewall kustoTI Map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI Map IP entity to Cloud App Events kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to DeviceNetworkEvents kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to Duo Security kustoTI Map IP entity to GitHub_CL kustoTI Map IP entity to Network Session Events (ASIM Network Session schema) +6 more rules	21	21
`IndicatorType`	`in`	`ipv6-addr` kustoTI Map IP entity to AppServiceHTTPLogs kustoTI Map IP entity to AWSCloudTrail kustoTI Map IP entity to Azure Key Vault logs kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to AzureActivity kustoTI Map IP entity to AzureFirewall kustoTI Map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI Map IP entity to Cloud App Events kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to DeviceNetworkEvents kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to Duo Security kustoTI Map IP entity to GitHub_CL kustoTI Map IP entity to Network Session Events (ASIM Network Session schema) kustoTI Map IP entity to OfficeActivity +5 more rules	20	20
`process_name`	`wildcard`	`python*` elasticDNS Request by Recently Created Executable elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticEgress Network Connection from Node.js Descendant elasticExecution via OpenClaw Agent elasticLinux Reverse Shell via setsid and nohup elasticLinux Reverse Shell via Suspicious Utility elasticPayload Downloaded and Piped to Interpreter elasticPayload Downloaded by Interpreter and Piped to Interpreter elasticPayload Execution via Shell Pipe Detected by Defend for Containers elasticPotential Remote Code Execution via URL Encoded Payload elasticPotential Reverse Shell via Suspicious Child Process elasticPotential Reverse Shell via UDP elasticSuspicious File Creation via Web Server +3 more rules	18	69
`process_name`	`wildcard`	`lua*` elasticDNS Request by Recently Created Executable elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticEgress Network Connection from Node.js Descendant elasticLinux Reverse Shell via setsid and nohup elasticLinux Reverse Shell via Suspicious Utility elasticPayload Downloaded and Piped to Interpreter elasticPayload Downloaded by Interpreter and Piped to Interpreter elasticPayload Execution via Shell Pipe Detected by Defend for Containers elasticPotential Remote Code Execution via URL Encoded Payload elasticPotential Reverse Shell via Suspicious Child Process elasticPotential Reverse Shell via UDP elasticSuspicious File Downloaded by Curl/Wget and Piped to Interpreter	14	32
`process_name`	`wildcard`	`php*` elasticDNS Request by Recently Created Executable elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticEgress Network Connection from Node.js Descendant elasticLinux Reverse Shell via setsid and nohup elasticLinux Reverse Shell via Suspicious Utility elasticPayload Downloaded and Piped to Interpreter elasticPayload Downloaded by Interpreter and Piped to Interpreter elasticPayload Execution via Shell Pipe Detected by Defend for Containers elasticPotential Remote Code Execution via URL Encoded Payload elasticPotential Reverse Shell via Suspicious Child Process elasticPotential Reverse Shell via UDP elasticSuspicious File Downloaded by Curl/Wget and Piped to Interpreter	14	39
`EventType`	`in`	`connection_attempted` elasticHidden Process Execution followed by Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via netcat elasticPANW and Elastic Defend - Command and Control Correlation elasticPossible JAVA Reverse Shell elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Java elasticPotential Reverse Shell via Java elasticPotential Reverse Shell via Suspicious Binary elasticPotential Reverse Shell via Suspicious Child Process elasticSuricata and Elastic Defend Network Correlation elasticSuspicious Network Activity to the Internet by Previously Unknown Executable elasticSuspicious PHP Script Execution	15	26
`EventType`	`in`	`exec` elasticConnection to External Network via Telnet elasticCurl or Wget Spawned via Node.js elasticLinux Reverse Shell elasticLinux Telegram API Request elasticOpenssl Client or Server Activity elasticPayload Execution via Shell Pipe Detected by Defend for Containers elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Reverse Shell elasticPotential Reverse Shell via Background Process elasticPotential Reverse Shell via Suspicious Child Process elasticSimple HTTP Web Server Creation elasticSuspicious Command Execution via Busybox Proxy elasticSuspicious Named Pipe Creation	13	201
`process.args`	`eq`	`-c` elasticCommand Interpreter with IP Address Argument elasticEgress Network Connection from Node.js Descendant elasticLinux Reverse Shell via Suspicious Utility elasticPotential Python Reverse Shell elasticPotential Remote Code Execution via Database Server elasticPotential Remote Code Execution via Langflow elasticPotential Remote Code Execution via Mail Server elasticPotential Reverse Shell via Suspicious Child Process elasticPython Network Connection Followed by Command Execution elasticReverse or Bind Shell via Suspicious Utility elasticShell Execution via Java Parent Process elasticSuspicious Installer Package Spawns Network Event elasticSuspicious Interpreter Execution Detected via Defend for Containers elasticSuspicious Shell Command Execution via Node.js Parent elasticSuspicious Shell Execution via Java Application	15	107
`Image`	`starts_with`	`/dev/shm/` elasticDNS Request by Suspicious Process Executable elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Node.js Descendant elasticHigh Number of Egress Network Connections from Unusual Executable elasticNetwork Connection Followed by File Creation elasticOutbound Network Connection Followed by Process File Deletion elasticPotential Remote Code Execution via Database Server elasticPotential Remote Code Execution via Mail Server elasticPotential Remote Code Execution via URL Encoded Payload elasticPotential Reverse Shell Activity via TCP/UDP Socket elasticSuspicious Network Activity to the Internet by Previously Unknown Executable elasticSuspicious Process Execution Detected via Defend for Containers elasticSuspicious Web Server Child Process elasticSystem Path File Creation and Execution Detected via Defend for Containers	14	53
`Image`	`starts_with`	`/tmp/` elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Node.js Descendant elasticHigh Number of Egress Network Connections from Unusual Executable elasticNetwork Connection Followed by File Creation elasticOutbound Network Connection Followed by Process File Deletion elasticPotential Remote Code Execution via Database Server elasticPotential Remote Code Execution via Mail Server elasticPotential Remote Code Execution via URL Encoded Payload elasticPotential Reverse Shell Activity via TCP/UDP Socket elasticSuspicious Network Activity to the Internet by Previously Unknown Executable elasticSuspicious Process Execution Detected via Defend for Containers elasticSuspicious Terraform Provider Execution and Network Connection elasticSuspicious Web Server Child Process elasticSystem Path File Creation and Execution Detected via Defend for Containers	14	58
`Image`	`starts_with`	`/var/tmp/` elasticDNS Request by Suspicious Process Executable elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Node.js Descendant elasticHigh Number of Egress Network Connections from Unusual Executable elasticNetwork Connection Followed by File Creation elasticOutbound Network Connection Followed by Process File Deletion elasticPotential Remote Code Execution via Database Server elasticPotential Remote Code Execution via Mail Server elasticPotential Remote Code Execution via URL Encoded Payload elasticPotential Reverse Shell Activity via TCP/UDP Socket elasticSuspicious Network Activity to the Internet by Previously Unknown Executable elasticSuspicious Process Execution Detected via Defend for Containers elasticSuspicious Web Server Child Process elasticSystem Path File Creation and Execution Detected via Defend for Containers	14	56
`IsActive`	`eq`	`true` kustoGoogle Threat Intelligence - Threat Hunting Domain kustoGoogle Threat Intelligence - Threat Hunting IP kustoHoneyLabs TI Map IP Entity to CommonSecurityLog kustoHoneyLabs TI Map IP Entity to Network Session (ASIM) kustoHoneyLabs TI Map URL Entity to CommonSecurityLog kustoLumen TI domain in DnsEvents kustoLumen TI IPAddress in CommonSecurityLog kustoLumen TI IPAddress in DeviceEvents kustoLumen TI IPAddress in IdentityLogonEvents kustoLumen TI IPAddress in OfficeActivity kustoLumen TI IPAddress in SecurityEvents kustoLumen TI IPAddress in SigninLogs kustoLumen TI IPAddress in WindowsEvents	13	21
`process_name`	`starts_with`	`python` elasticDNS Query to Suspicious Top Level Domain elasticDNS Request to Crypto Miner Service elasticEgress Network Connection from Node.js Descendant elasticLinux Reverse Shell via Suspicious Utility elasticPayload Downloaded and Piped to Interpreter elasticPayload Downloaded by Interpreter and Piped to Interpreter elasticPotential Python Reverse Shell elasticPotential Reverse Shell via Suspicious Child Process elasticPython Network Connection Followed by Command Execution elasticScript DNS Query to Managed Kubernetes Cluster elasticSimple HTTP Web Server Connection elasticSimple HTTP Web Server Creation elasticUnusual File Creation via Web Server	13	71

Exclusions (2364 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`dest_ip`	`cidr_match`	`127.0.0.0/8` sigmaOutbound Network Connection Initiated By Microsoft Dialer elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell +38 more rules	53
`dest_ip`	`cidr_match`	`169.254.0.0/16` sigmaOutbound Network Connection Initiated By Microsoft Dialer elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell +38 more rules	53
`dest_ip`	`cidr_match`	`::1` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via Child +32 more rules	47
`dest_ip`	`cidr_match`	`10.0.0.0/8` sigmaOutbound Network Connection Initiated By Microsoft Dialer elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell +31 more rules	46
`dest_ip`	`cidr_match`	`172.16.0.0/12` sigmaOutbound Network Connection Initiated By Microsoft Dialer elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell +31 more rules	46
`dest_ip`	`cidr_match`	`224.0.0.0/4` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via Child +31 more rules	46
`dest_ip`	`cidr_match`	`192.168.0.0/16` sigmaOutbound Network Connection Initiated By Microsoft Dialer elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell +30 more rules	45
`dest_ip`	`cidr_match`	`192.0.0.0/24` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via netcat +24 more rules	39
`dest_ip`	`cidr_match`	`192.0.2.0/24` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via netcat +24 more rules	39
`dest_ip`	`cidr_match`	`192.88.99.0/24` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via netcat +24 more rules	39
`dest_ip`	`cidr_match`	`240.0.0.0/4` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via netcat +24 more rules	39
`dest_ip`	`cidr_match`	`FE80::/10` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via netcat +24 more rules	39
`dest_ip`	`cidr_match`	`FF00::/8` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via netcat +24 more rules	39
`dest_ip`	`cidr_match`	`100.64.0.0/10` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via netcat +23 more rules	38
`dest_ip`	`cidr_match`	`192.175.48.0/24` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via netcat +23 more rules	38

Application Layer Protocol `T1071`

Events covered

Authoring guide

Fields filtered most (370 distinct)

Top indicator values (4853 distinct)

Exclusions (2364 distinct)

Rules under this technique

Sigma 70 rules

Elastic 196 rules

Splunk 47 rules

Kusto 186 rules

YARA-L 2 rules

Panther 5 rules

Application Layer Protocol T1071

Events covered

Authoring guide

Fields filtered most (370 distinct)

Top indicator values (4853 distinct)

Exclusions (2364 distinct)

Rules under this technique

Sigma 70 rules

Elastic 196 rules

Splunk 47 rules

Kusto 186 rules

YARA-L 2 rules

Panther 5 rules

Application Layer Protocol `T1071`