Application Layer Protocol `T1071`

Tactic: Command & Control

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Events covered

30 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 3	Network connection
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Sysmon	Event ID 15	FileCreateStreamHash
Sysmon	Event ID 17	PipeEvent (Pipe Created)
Sysmon	Event ID 18	PipeEvent (Pipe Connected)
Sysmon	Event ID 22	DNSEvent (DNS query)
Security-Auditing	Event ID 4662	An operation was performed on an object.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4698	A scheduled task was created.
Security-Auditing	Event ID 5136	A directory service object was modified.
Security-Auditing	Event ID 5137	A directory service object was created.
Security-Auditing	Event ID 5152	The Windows Filtering Platform blocked a packet.
Security-Auditing	Event ID 5154	The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
Security-Auditing	Event ID 5155	The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
Security-Auditing	Event ID 5156	The Windows Filtering Platform has permitted a connection.
Security-Auditing	Event ID 5157	The Windows Filtering Platform has blocked a connection.
Security-Auditing	Event ID 5158	The Windows Filtering Platform has permitted a bind to a local port.
Security-Auditing	Event ID 5159	The Windows Filtering Platform has blocked a bind to a local port.
Defender-DeviceEvents	any	Defender event (any)
ESF	exec	Process Execution (Notify)
DNS-Client	Event ID 3008	DNS query is completed for the name QueryName, type QueryType, query options QueryOptions with status QueryStatus Results QueryResults.
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 800	Event ID 800
Service-Control-Manager	Event ID 7045	A service was installed in the system.
Sysmon-for-Linux	Event ID 1	Process Create

Authoring guide

Patterns shared across the 388 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (336 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Field	Rules	How	Sample values
`EventType`	66	`eq` 49, `in` 21, `ne` 1	`exec`, `connection_attempted`, `ProcessRollup2`, `connection_accepted`, `exec_event`
`process_name`	59	`eq` 27, `in` 21, `wildcard` 9, `starts_with` 8, `is_not_null` 5, `match` 3, `ends_with` 1, `ne` 1	`bash`, `csh`, `curl`, `busybox`, `dash`
`event.type`	54	`eq` 54	`start`, `creation`, `connection`, `protocol`
`Active`	49	`eq` 49	`true`
`ValidUntil`	47	`is_null` 47, `time_range` 47
`IndicatorType`	45	`eq` 24, `in` 21	`ipv4-addr`, `network-traffic`, `ipv6-addr`, `domain-name`, `url`
`host.os.type`	45	`eq` 44, `in` 2
`Image`	35	`ends_with` 21, `starts_with` 6, `wildcard` 5, `eq` 3, `contains` 2, `is_not_null` 2, `in` 1	`/dev/shm/`, `./`, `/curl`, `/media/`, `/boot/`
`CommandLine`	33	`contains` 22, `regex_match` 6, `ends_with` 3, `match` 3, `is_not_null` 2, `wildcard` 2	`(?i)ftp\s+(.{1,})?\-s\:.{1,}\.\w{2,5}`, `--user-agent` , `-a` , `(\s+\-[Nvw]+\s+\d+?.*?(((\d{1,3}\.){3}\d{1,3})\|(\w?\wtps?...`, `--accept-server-license-terms`
`EventID`	30	`eq` 23, `in` 5, `regex_match` 2	`3`, `1`, `22`, `17`, `18`
`NetworkSourceIP`	22	`is_not_null` 22
`EmailSourceIpAddress`	21	`is_not_null` 21
`NetworkDestinationIP`	21	`is_not_null` 21
`NetworkIP`	21	`is_not_null` 21
`process.args`	21	`eq` 12, `in` 7, `wildcard` 7, `starts_with` 5, `contains` 4, `match` 4, `ends_with` 1, `ne` 1	`--output`, `-c`, `-i`, `-l`, `socat `

Top indicator values (3000 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticApple Script Execution followed by Network Connection elasticConnection to External Network via Telnet elasticCurl or Wget Spawned via Node.js elasticDeprecated - Uncommon Destination Port Connection by Web Server elasticDeprecated - Unusual Command Execution from Web Server Parent elasticDeprecated - Unusual Process Spawned from Web Server Parent elasticEgress Connection from Entrypoint in Container elasticExecution via OpenClaw Agent elasticFile Creation and Execution Detected via Defend for Containers elasticFile Download Detected via Defend for Containers elasticGit Hook Egress Network Connection elasticGit Repository or File Download to Suspicious Directory elasticHigh Number of Egress Network Connections from Unusual Executable elasticLinux Telegram API Request elasticMsBuild Making Network Connections elasticNetwork Connection from Binary with RWX Memory Region elasticNetwork Connection via Compiled HTML File elasticNetwork Connection via Recently Compiled Executable elasticOpenssl Client or Server Activity elasticPayload Execution via Shell Pipe Detected by Defend for Containers elasticPerl Outbound Network Connection elasticPotential Command and Control via Internet Explorer elasticPotential DNS Tunneling via NsLookup elasticPotential File Transfer via Certreq elasticPotential File Transfer via Curl for Windows elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Malware-Driven SSH Brute Force Attempt elasticPotential Reverse Shell elasticPotential Reverse Shell via Background Process elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Binary elasticPotential Reverse Shell via Suspicious Child Process elasticPotential Reverse Shell via UDP elasticRoot Network Connection via GDB CAP_SYS_PTRACE elasticSimple HTTP Web Server Connection elasticSimple HTTP Web Server Creation elasticSuspicious Command Prompt Network Connection elasticSuspicious Curl from macOS Application elasticSuspicious Curl to Google App Script Endpoint elasticSuspicious Execution from a WebDav Share elasticSuspicious Installer Package Spawns Network Event elasticSuspicious Interpreter Execution Detected via Defend for Containers elasticSuspicious Named Pipe Creation elasticSuspicious Process Execution Detected via Defend for Containers elasticUnusual Child Execution via Web Server elasticUnusual Command Execution via Web Server elasticUnusual Network Connection to Suspicious Top Level Domain elasticUnusual Network Connection to Suspicious Web Service elasticUnusual Network Connection via DllHost elasticUnusual Network Connection via RunDLL32 elasticWeb Server Exploitation Detected via Defend for Containers	51	606
`Active`	`eq`	`true` kustoGreyNoise TI Map IP Entity to CommonSecurityLog kustoGreyNoise TI Map IP Entity to DnsEvents kustoGreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema) kustoGreyNoise TI map IP entity to OfficeActivity kustoPreview - TI map Domain entity to Cloud App Events kustoPreview - TI map IP entity to Cloud App Events kustoPreview - TI map URL entity to Cloud App Events kustoThreat Connect TI map Domain entity to DnsEvents kustoThreatConnect TI map Email entity to OfficeActivity kustoThreatConnect TI map IP entity to Network Session Events (ASIM Network Session schema) kustoThreatConnect TI Map URL Entity to OfficeActivity Data kustoTI Map Domain Entity to DeviceNetworkEvents kustoTI map Domain entity to Dns Events (ASIM DNS Schema) kustoTI map Domain entity to DnsEvents kustoTI map Domain entity to PaloAlto kustoTI map Domain entity to PaloAlto CommonSecurityLog kustoTI map Domain entity to SecurityAlert kustoTI map Domain entity to Syslog kustoTI map Domain entity to Web Session Events (ASIM Web Session schema) kustoTI map File Hash to CommonSecurityLog Event kustoTI map File Hash to DeviceFileEvents Event kustoTI map File Hash to Security Event kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to Azure Key Vault logs kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to AzureActivity kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to DeviceNetworkEvents kustoTI map IP entity to DNS Events (ASIM DNS schema) kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to Duo Security kustoTI map IP entity to GitHub_CL kustoTI map IP entity to Network Session Events (ASIM Network Session schema) kustoTI map IP entity to OfficeActivity kustoTI Map IP Entity to SigninLogs kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to W3CIISLog kustoTI map IP entity to Web Session Events (ASIM Web Session schema) kustoTI map IP entity to Workday(ASimAuditEventLogs) kustoTI Map URL Entity to AuditLogs kustoTI Map URL Entity to DeviceNetworkEvents kustoTI Map URL Entity to EmailUrlInfo kustoTI Map URL Entity to PaloAlto Data kustoTI Map URL Entity to SecurityAlert Data kustoTI Map URL Entity to Syslog Data kustoTI Map URL Entity to UrlClickEvents	49	68
`EventType`	`eq`	`exec` sigmamacOS DNS Query Tools for C2 sigmamacOS HTTP Tools with Protocol Indicators sigmamacOS Network Utility Tools for C2 elasticDeprecated - Unusual Command Execution from Web Server Parent elasticDeprecated - Unusual Process Spawned from Web Server Parent elasticEgress Connection from Entrypoint in Container elasticFile Creation and Execution Detected via Defend for Containers elasticFile Download Detected via Defend for Containers elasticGit Hook Egress Network Connection elasticGit Repository or File Download to Suspicious Directory elasticNetwork Connection via Recently Compiled Executable elasticPayload Execution via Shell Pipe Detected by Defend for Containers elasticPerl Outbound Network Connection elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Java elasticPotential Reverse Shell via Suspicious Binary elasticRoot Network Connection via GDB CAP_SYS_PTRACE elasticSuspicious Curl from macOS Application elasticSuspicious Installer Package Spawns Network Event elasticSuspicious Interpreter Execution Detected via Defend for Containers elasticSuspicious Process Execution Detected via Defend for Containers elasticUnusual Child Execution via Web Server elasticUnusual Command Execution via Web Server elasticWeb Server Exploitation Detected via Defend for Containers	24	171
`EventType`	`eq`	`connection_attempted` elasticDeprecated - Uncommon Destination Port Connection by Web Server elasticEgress Connection from Entrypoint in Container elasticGenAI Process Connection to Unusual Domain elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticMsBuild Making Network Connections elasticNetwork Connection from Binary with RWX Memory Region elasticNetwork Connection via Recently Compiled Executable elasticPotential Malware-Driven SSH Brute Force Attempt elasticRoot Network Connection via GDB CAP_SYS_PTRACE	10	25
`IndicatorType`	`in`	`ipv4-addr` kustoGSA - TI IP Entity kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to Azure Key Vault logs kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to AzureActivity kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI map IP entity to Cloud App Events kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to DeviceNetworkEvents kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to Duo Security kustoTI map IP entity to GitHub_CL kustoTI map IP entity to Network Session Events (ASIM Network Session schema) kustoTI map IP entity to OfficeActivity kustoTI Map IP Entity to SigninLogs kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to W3CIISLog kustoTI map IP entity to Web Session Events (ASIM Web Session schema) kustoTI map IP entity to Workday(ASimAuditEventLogs)	21	21
`IndicatorType`	`in`	`network-traffic` kustoGSA - TI IP Entity kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to Azure Key Vault logs kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to AzureActivity kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI map IP entity to Cloud App Events kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to DeviceNetworkEvents kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to Duo Security kustoTI map IP entity to GitHub_CL kustoTI map IP entity to Network Session Events (ASIM Network Session schema) kustoTI map IP entity to OfficeActivity kustoTI Map IP Entity to SigninLogs kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to W3CIISLog kustoTI map IP entity to Web Session Events (ASIM Web Session schema) kustoTI map IP entity to Workday(ASimAuditEventLogs)	21	21
`IndicatorType`	`in`	`ipv6-addr` kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to Azure Key Vault logs kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to AzureActivity kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI map IP entity to Cloud App Events kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to DeviceNetworkEvents kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to Duo Security kustoTI map IP entity to GitHub_CL kustoTI map IP entity to Network Session Events (ASIM Network Session schema) kustoTI map IP entity to OfficeActivity kustoTI Map IP Entity to SigninLogs kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to W3CIISLog kustoTI map IP entity to Web Session Events (ASIM Web Session schema) kustoTI map IP entity to Workday(ASimAuditEventLogs)	20	20
`EventType`	`in`	`exec` elasticConnection to External Network via Telnet elasticCurl or Wget Spawned via Node.js elasticLinux Telegram API Request elasticOpenssl Client or Server Activity elasticPayload Execution via Shell Pipe Detected by Defend for Containers elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Reverse Shell elasticPotential Reverse Shell via Background Process elasticPotential Reverse Shell via Suspicious Child Process elasticSimple HTTP Web Server Creation elasticSuspicious Named Pipe Creation	11	171
`EventType`	`in`	`connection_attempted` elasticPANW and Elastic Defend - Command and Control Correlation elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Java elasticPotential Reverse Shell via Suspicious Binary elasticPotential Reverse Shell via Suspicious Child Process elasticSuricata and Elastic Defend Network Correlation elasticSuspicious Network Activity to the Internet by Previously Unknown Executable	8	12
`EventType`	`in`	`start` elasticConnection to External Network via Telnet elasticCurl or Wget Spawned via Node.js elasticLinux Telegram API Request elasticOpenssl Client or Server Activity elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Reverse Shell via Background Process elasticSimple HTTP Web Server Creation elasticSuspicious Named Pipe Creation	8	134
`IndicatorType`	`eq`	`domain-name` kustoGSA - TI Domain Entity kustoTI map Domain entity to Cloud App Events kustoTI Map Domain Entity to DeviceNetworkEvents kustoTI map Domain entity to Dns Events (ASIM DNS Schema) kustoTI map Domain entity to DnsEvents kustoTI map Domain entity to PaloAlto kustoTI map Domain entity to PaloAlto CommonSecurityLog kustoTI map Domain entity to SecurityAlert kustoTI map Domain entity to Syslog kustoTI map Domain entity to Web Session Events (ASIM Web Session schema)	10	11
`IndicatorType`	`eq`	`url` kustoGSA - TI URL Entity kustoTI Map URL Entity to AuditLogs kustoTI map URL entity to Cloud App Events kustoTI Map URL Entity to DeviceNetworkEvents kustoTI Map URL Entity to EmailUrlInfo kustoTI Map URL Entity to PaloAlto Data kustoTI Map URL Entity to SecurityAlert Data kustoTI Map URL Entity to Syslog Data kustoTI Map URL Entity to UrlClickEvents kustoTI map URL entity to Web Session Events (ASIM Web Session schema)	10	11
`IsActive`	`eq`	`true` kustoGoogle Threat Intelligence - Threat Hunting Domain kustoGoogle Threat Intelligence - Threat Hunting IP kustoLumen TI domain in DnsEvents kustoLumen TI IPAddress in CommonSecurityLog kustoLumen TI IPAddress in DeviceEvents kustoLumen TI IPAddress in IdentityLogonEvents kustoLumen TI IPAddress in OfficeActivity kustoLumen TI IPAddress in SecurityEvents kustoLumen TI IPAddress in SigninLogs kustoLumen TI IPAddress in WindowsEvents	10	17
`process_name`	`in`	`bash` elasticCurl or Wget Spawned via Node.js elasticDeprecated - Unusual Command Execution from Web Server Parent elasticDeprecated - Unusual Process Spawned from Web Server Parent elasticGit Hook Egress Network Connection elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Java elasticSuspicious Installer Package Spawns Network Event elasticUnusual Command Execution via Web Server elasticWeb Server Exploitation Detected via Defend for Containers	10	88
`process_name`	`in`	`sh` elasticCurl or Wget Spawned via Node.js elasticDeprecated - Unusual Command Execution from Web Server Parent elasticDeprecated - Unusual Process Spawned from Web Server Parent elasticGit Hook Egress Network Connection elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Java elasticSuspicious Installer Package Spawns Network Event elasticUnusual Command Execution via Web Server elasticWeb Server Exploitation Detected via Defend for Containers	10	83
`process_name`	`in`	`zsh` elasticCurl or Wget Spawned via Node.js elasticDeprecated - Unusual Command Execution from Web Server Parent elasticDeprecated - Unusual Process Spawned from Web Server Parent elasticGit Hook Egress Network Connection elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Java elasticSuspicious Installer Package Spawns Network Event elasticUnusual Command Execution via Web Server elasticWeb Server Exploitation Detected via Defend for Containers	10	82
`process_name`	`in`	`csh` elasticCurl or Wget Spawned via Node.js elasticDeprecated - Unusual Command Execution from Web Server Parent elasticDeprecated - Unusual Process Spawned from Web Server Parent elasticGit Hook Egress Network Connection elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Java elasticUnusual Command Execution via Web Server elasticWeb Server Exploitation Detected via Defend for Containers	9	71
`process_name`	`in`	`dash` elasticCurl or Wget Spawned via Node.js elasticDeprecated - Unusual Command Execution from Web Server Parent elasticDeprecated - Unusual Process Spawned from Web Server Parent elasticGit Hook Egress Network Connection elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Java elasticUnusual Command Execution via Web Server elasticWeb Server Exploitation Detected via Defend for Containers	9	78
`process_name`	`in`	`fish` elasticCurl or Wget Spawned via Node.js elasticDeprecated - Unusual Command Execution from Web Server Parent elasticDeprecated - Unusual Process Spawned from Web Server Parent elasticGit Hook Egress Network Connection elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Java elasticUnusual Command Execution via Web Server elasticWeb Server Exploitation Detected via Defend for Containers	9	72
`process_name`	`in`	`ksh` elasticCurl or Wget Spawned via Node.js elasticDeprecated - Unusual Command Execution from Web Server Parent elasticDeprecated - Unusual Process Spawned from Web Server Parent elasticGit Hook Egress Network Connection elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Java elasticUnusual Command Execution via Web Server elasticWeb Server Exploitation Detected via Defend for Containers	9	73
`process_name`	`in`	`tcsh` elasticCurl or Wget Spawned via Node.js elasticDeprecated - Unusual Command Execution from Web Server Parent elasticDeprecated - Unusual Process Spawned from Web Server Parent elasticGit Hook Egress Network Connection elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Java elasticUnusual Command Execution via Web Server elasticWeb Server Exploitation Detected via Defend for Containers	9	69
`ObservableKey`	`eq`	`ipv4-addr:value` kustoGoogle Threat Intelligence - Threat Hunting IP kustoLumen TI IPAddress in CommonSecurityLog kustoLumen TI IPAddress in DeviceEvents kustoLumen TI IPAddress in IdentityLogonEvents kustoLumen TI IPAddress in OfficeActivity kustoLumen TI IPAddress in SecurityEvents kustoLumen TI IPAddress in SigninLogs kustoLumen TI IPAddress in WindowsEvents	8	9
`SourceSystem`	`eq`	`Lumen` kustoLumen TI domain in DnsEvents kustoLumen TI IPAddress in CommonSecurityLog kustoLumen TI IPAddress in DeviceEvents kustoLumen TI IPAddress in IdentityLogonEvents kustoLumen TI IPAddress in OfficeActivity kustoLumen TI IPAddress in SecurityEvents kustoLumen TI IPAddress in SigninLogs kustoLumen TI IPAddress in WindowsEvents	8	8
`DeviceProduct`	`eq`	`X Series` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - New Campaign Detected kustoVectra AI Detect - Suspected Compromised Account kustoVectra AI Detect - Suspected Compromised Host kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	7	7
`DeviceVendor`	`eq`	`Vectra Networks` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - New Campaign Detected kustoVectra AI Detect - Suspected Compromised Account kustoVectra AI Detect - Suspected Compromised Host kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	7	7
`EventID`	`eq`	`3` splunkUnexpected Network Connection from System Process (Sysmon) splunkUnusual HTTP Download (Sysmon) splunkWindows File Transfer Protocol In Non-Common Process Path splunkWindows Mail Protocol In Non-Common Process Path kustoEuropium - Hash and IP IOCs - September 2022 kustoLog4j vulnerability exploit aka Log4Shell IP IOC kustoMercury - Domain, Hash and IP IOCs - August 2022	7	21
`tld`	`eq`	`list_tlds` kustoThreat Connect TI map Domain entity to DnsEvents kustoTI map Domain entity to DnsEvents kustoTI map Domain entity to DnsEvents kustoTI map Domain entity to PaloAlto kustoTI map Domain entity to PaloAlto kustoTI map Domain entity to Syslog kustoTI map Domain entity to Syslog	7	7
`CommonSecurityLog_TimeGenerated`	`lt`	`ExpirationDateTime` kustoGreyNoise TI Map IP Entity to CommonSecurityLog kustoTI map Domain entity to PaloAlto kustoTI map Domain entity to PaloAlto CommonSecurityLog kustoTI map File Hash to CommonSecurityLog Event kustoTI Map IP Entity to CommonSecurityLog kustoTI Map URL Entity to PaloAlto Data	6	7
`CommonSecurityLog_TimeGenerated`	`lt`	`ValidUntil` kustoLumen TI IPAddress in CommonSecurityLog kustoTI map Domain entity to PaloAlto kustoTI map Domain entity to PaloAlto CommonSecurityLog kustoTI map File Hash to CommonSecurityLog Event kustoTI Map IP Entity to CommonSecurityLog kustoTI Map URL Entity to PaloAlto Data	6	7
`DeviceEventClassID`	`eq`	`url` kustoTI map Domain entity to PaloAlto kustoTI map Domain entity to PaloAlto kustoTI map Domain entity to PaloAlto CommonSecurityLog kustoTI map Domain entity to PaloAlto CommonSecurityLog kustoTI Map URL Entity to PaloAlto Data kustoTI Map URL Entity to PaloAlto Data	6	6

Exclusions (765 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Field	Kind	Value	Rules excluding
`TI_ipEntity`	`cidr_match`	`10.0.0.0/8` kustoGreyNoise TI Map IP Entity to CommonSecurityLog kustoGreyNoise TI Map IP Entity to DnsEvents kustoGreyNoise TI map IP entity to OfficeActivity kustoLumen TI IPAddress in CommonSecurityLog kustoLumen TI IPAddress in DeviceEvents kustoLumen TI IPAddress in IdentityLogonEvents kustoLumen TI IPAddress in OfficeActivity kustoLumen TI IPAddress in SecurityEvents kustoLumen TI IPAddress in SigninLogs kustoLumen TI IPAddress in WindowsEvents kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to Azure Key Vault logs kustoTI map IP entity to Azure Key Vault logs kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to AzureActivity kustoTI Map IP Entity to AzureActivity kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to W3CIISLog kustoTI Map IP Entity to W3CIISLog kustoTI map IP entity to Web Session Events (ASIM Web Session schema) kustoTI map IP entity to Web Session Events (ASIM Web Session schema)	34
`TI_ipEntity`	`cidr_match`	`127.0.0.0/8` kustoGreyNoise TI Map IP Entity to CommonSecurityLog kustoGreyNoise TI Map IP Entity to DnsEvents kustoGreyNoise TI map IP entity to OfficeActivity kustoLumen TI IPAddress in CommonSecurityLog kustoLumen TI IPAddress in DeviceEvents kustoLumen TI IPAddress in IdentityLogonEvents kustoLumen TI IPAddress in OfficeActivity kustoLumen TI IPAddress in SecurityEvents kustoLumen TI IPAddress in SigninLogs kustoLumen TI IPAddress in WindowsEvents kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to Azure Key Vault logs kustoTI map IP entity to Azure Key Vault logs kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to AzureActivity kustoTI Map IP Entity to AzureActivity kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to W3CIISLog kustoTI Map IP Entity to W3CIISLog kustoTI map IP entity to Web Session Events (ASIM Web Session schema) kustoTI map IP entity to Web Session Events (ASIM Web Session schema)	34
`TI_ipEntity`	`cidr_match`	`169.254.0.0/16` kustoGreyNoise TI Map IP Entity to CommonSecurityLog kustoGreyNoise TI Map IP Entity to DnsEvents kustoGreyNoise TI map IP entity to OfficeActivity kustoLumen TI IPAddress in CommonSecurityLog kustoLumen TI IPAddress in DeviceEvents kustoLumen TI IPAddress in IdentityLogonEvents kustoLumen TI IPAddress in OfficeActivity kustoLumen TI IPAddress in SecurityEvents kustoLumen TI IPAddress in SigninLogs kustoLumen TI IPAddress in WindowsEvents kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to Azure Key Vault logs kustoTI map IP entity to Azure Key Vault logs kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to AzureActivity kustoTI Map IP Entity to AzureActivity kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to W3CIISLog kustoTI Map IP Entity to W3CIISLog kustoTI map IP entity to Web Session Events (ASIM Web Session schema) kustoTI map IP entity to Web Session Events (ASIM Web Session schema)	34
`TI_ipEntity`	`cidr_match`	`172.16.0.0/12` kustoGreyNoise TI Map IP Entity to CommonSecurityLog kustoGreyNoise TI Map IP Entity to DnsEvents kustoGreyNoise TI map IP entity to OfficeActivity kustoLumen TI IPAddress in CommonSecurityLog kustoLumen TI IPAddress in DeviceEvents kustoLumen TI IPAddress in IdentityLogonEvents kustoLumen TI IPAddress in OfficeActivity kustoLumen TI IPAddress in SecurityEvents kustoLumen TI IPAddress in SigninLogs kustoLumen TI IPAddress in WindowsEvents kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to Azure Key Vault logs kustoTI map IP entity to Azure Key Vault logs kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to AzureActivity kustoTI Map IP Entity to AzureActivity kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to W3CIISLog kustoTI Map IP Entity to W3CIISLog kustoTI map IP entity to Web Session Events (ASIM Web Session schema) kustoTI map IP entity to Web Session Events (ASIM Web Session schema)	34
`TI_ipEntity`	`cidr_match`	`192.168.0.0/16` kustoGreyNoise TI Map IP Entity to CommonSecurityLog kustoGreyNoise TI Map IP Entity to DnsEvents kustoGreyNoise TI map IP entity to OfficeActivity kustoLumen TI IPAddress in CommonSecurityLog kustoLumen TI IPAddress in DeviceEvents kustoLumen TI IPAddress in IdentityLogonEvents kustoLumen TI IPAddress in OfficeActivity kustoLumen TI IPAddress in SecurityEvents kustoLumen TI IPAddress in SigninLogs kustoLumen TI IPAddress in WindowsEvents kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to Azure Key Vault logs kustoTI map IP entity to Azure Key Vault logs kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to AzureActivity kustoTI Map IP Entity to AzureActivity kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to W3CIISLog kustoTI Map IP Entity to W3CIISLog kustoTI map IP entity to Web Session Events (ASIM Web Session schema) kustoTI map IP entity to Web Session Events (ASIM Web Session schema)	34
`TI_ipEntity`	`starts_with`	`127.` kustoGreyNoise TI Map IP Entity to CommonSecurityLog kustoGreyNoise TI Map IP Entity to DnsEvents kustoGreyNoise TI map IP entity to OfficeActivity kustoLumen TI IPAddress in CommonSecurityLog kustoLumen TI IPAddress in DeviceEvents kustoLumen TI IPAddress in IdentityLogonEvents kustoLumen TI IPAddress in OfficeActivity kustoLumen TI IPAddress in SecurityEvents kustoLumen TI IPAddress in SigninLogs kustoLumen TI IPAddress in WindowsEvents kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to Azure Key Vault logs kustoTI map IP entity to Azure Key Vault logs kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to AzureActivity kustoTI Map IP Entity to AzureActivity kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to W3CIISLog kustoTI Map IP Entity to W3CIISLog kustoTI map IP entity to Web Session Events (ASIM Web Session schema) kustoTI map IP entity to Web Session Events (ASIM Web Session schema)	34
`TI_ipEntity`	`starts_with`	`::` kustoGreyNoise TI Map IP Entity to CommonSecurityLog kustoGreyNoise TI Map IP Entity to DnsEvents kustoGreyNoise TI map IP entity to OfficeActivity kustoLumen TI IPAddress in CommonSecurityLog kustoLumen TI IPAddress in DeviceEvents kustoLumen TI IPAddress in IdentityLogonEvents kustoLumen TI IPAddress in OfficeActivity kustoLumen TI IPAddress in SecurityEvents kustoLumen TI IPAddress in SigninLogs kustoLumen TI IPAddress in WindowsEvents kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to Azure Key Vault logs kustoTI map IP entity to Azure Key Vault logs kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to AzureActivity kustoTI Map IP Entity to AzureActivity kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to W3CIISLog kustoTI Map IP Entity to W3CIISLog kustoTI map IP entity to Web Session Events (ASIM Web Session schema) kustoTI map IP entity to Web Session Events (ASIM Web Session schema)	34
`TI_ipEntity`	`starts_with`	`fe80` kustoGreyNoise TI Map IP Entity to CommonSecurityLog kustoGreyNoise TI Map IP Entity to DnsEvents kustoGreyNoise TI map IP entity to OfficeActivity kustoLumen TI IPAddress in CommonSecurityLog kustoLumen TI IPAddress in DeviceEvents kustoLumen TI IPAddress in IdentityLogonEvents kustoLumen TI IPAddress in OfficeActivity kustoLumen TI IPAddress in SecurityEvents kustoLumen TI IPAddress in SigninLogs kustoLumen TI IPAddress in WindowsEvents kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AppServiceHTTPLogs kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to AWSCloudTrail kustoTI map IP entity to Azure Key Vault logs kustoTI map IP entity to Azure Key Vault logs kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to Azure SQL Security Audit Events kustoTI Map IP Entity to AzureActivity kustoTI Map IP Entity to AzureActivity kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureFirewall kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to CommonSecurityLog kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to DnsEvents kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to VMConnection kustoTI Map IP Entity to W3CIISLog kustoTI Map IP Entity to W3CIISLog kustoTI map IP entity to Web Session Events (ASIM Web Session schema) kustoTI map IP entity to Web Session Events (ASIM Web Session schema)	34
`dest_ip`	`cidr_match`	`127.0.0.0/8` sigmaOutbound Network Connection Initiated By Microsoft Dialer elasticApple Script Execution followed by Network Connection elasticConnection to External Network via Telnet elasticDeprecated - Uncommon Destination Port Connection by Web Server elasticEgress Connection from Entrypoint in Container elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticNetwork Connection from Binary with RWX Memory Region elasticNetwork Connection via Compiled HTML File elasticNetwork Connection via Recently Compiled Executable elasticPerl Outbound Network Connection elasticPotential Malware-Driven SSH Brute Force Attempt elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Java elasticPotential Reverse Shell via Suspicious Child Process elasticPotential Reverse Shell via UDP elasticSuspicious Command Prompt Network Connection elasticUnusual Network Connection via DllHost elasticUnusual Network Connection via RunDLL32 kustoDetect presence of private IP addresses in URLs (ASIM Web Session) kustoDetect requests for an uncommon resources on the web (ASIM Web Session) kustoPotential beaconing activity (ASIM Network Session schema) kustoUbiquiti - Connection to known malicious IP or C2 kustoUbiquiti - Possible connection to cryptominning pool kustoUbiquiti - Unusual FTP connection to external server	26
`dest_ip`	`cidr_match`	`169.254.0.0/16` sigmaOutbound Network Connection Initiated By Microsoft Dialer elasticApple Script Execution followed by Network Connection elasticConnection to External Network via Telnet elasticDeprecated - Uncommon Destination Port Connection by Web Server elasticEgress Connection from Entrypoint in Container elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticNetwork Connection from Binary with RWX Memory Region elasticNetwork Connection via Compiled HTML File elasticNetwork Connection via Recently Compiled Executable elasticPerl Outbound Network Connection elasticPotential Malware-Driven SSH Brute Force Attempt elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Java elasticPotential Reverse Shell via Suspicious Child Process elasticPotential Reverse Shell via UDP elasticSuspicious Command Prompt Network Connection elasticUnusual Network Connection via DllHost elasticUnusual Network Connection via RunDLL32 kustoDetect presence of private IP addresses in URLs (ASIM Web Session) kustoDetect requests for an uncommon resources on the web (ASIM Web Session) kustoPotential beaconing activity (ASIM Network Session schema) kustoUbiquiti - Connection to known malicious IP or C2 kustoUbiquiti - Possible connection to cryptominning pool kustoUbiquiti - Unusual FTP connection to external server	26
`dest_ip`	`cidr_match`	`10.0.0.0/8` sigmaOutbound Network Connection Initiated By Microsoft Dialer elasticApple Script Execution followed by Network Connection elasticConnection to External Network via Telnet elasticDeprecated - Uncommon Destination Port Connection by Web Server elasticEgress Connection from Entrypoint in Container elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticNetwork Connection via Compiled HTML File elasticPerl Outbound Network Connection elasticPotential Malware-Driven SSH Brute Force Attempt elasticPotential Reverse Shell via Java elasticSuspicious Command Prompt Network Connection elasticUnusual Network Connection via DllHost elasticUnusual Network Connection via RunDLL32 kustoDetect presence of private IP addresses in URLs (ASIM Web Session) kustoDetect requests for an uncommon resources on the web (ASIM Web Session) kustoPotential beaconing activity (ASIM Network Session schema) kustoUbiquiti - Connection to known malicious IP or C2 kustoUbiquiti - Possible connection to cryptominning pool kustoUbiquiti - Unusual FTP connection to external server	20
`dest_ip`	`cidr_match`	`172.16.0.0/12` sigmaOutbound Network Connection Initiated By Microsoft Dialer elasticApple Script Execution followed by Network Connection elasticConnection to External Network via Telnet elasticDeprecated - Uncommon Destination Port Connection by Web Server elasticEgress Connection from Entrypoint in Container elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticNetwork Connection via Compiled HTML File elasticPerl Outbound Network Connection elasticPotential Malware-Driven SSH Brute Force Attempt elasticPotential Reverse Shell via Java elasticSuspicious Command Prompt Network Connection elasticUnusual Network Connection via DllHost elasticUnusual Network Connection via RunDLL32 kustoDetect presence of private IP addresses in URLs (ASIM Web Session) kustoDetect requests for an uncommon resources on the web (ASIM Web Session) kustoPotential beaconing activity (ASIM Network Session schema) kustoUbiquiti - Connection to known malicious IP or C2 kustoUbiquiti - Possible connection to cryptominning pool kustoUbiquiti - Unusual FTP connection to external server	20
`dest_ip`	`cidr_match`	`192.168.0.0/16` sigmaOutbound Network Connection Initiated By Microsoft Dialer elasticApple Script Execution followed by Network Connection elasticConnection to External Network via Telnet elasticDeprecated - Uncommon Destination Port Connection by Web Server elasticEgress Connection from Entrypoint in Container elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticNetwork Connection via Compiled HTML File elasticPerl Outbound Network Connection elasticPotential Malware-Driven SSH Brute Force Attempt elasticPotential Reverse Shell via Java elasticSuspicious Command Prompt Network Connection elasticUnusual Network Connection via DllHost elasticUnusual Network Connection via RunDLL32 kustoDetect presence of private IP addresses in URLs (ASIM Web Session) kustoDetect requests for an uncommon resources on the web (ASIM Web Session) kustoPotential beaconing activity (ASIM Network Session schema) kustoUbiquiti - Connection to known malicious IP or C2 kustoUbiquiti - Possible connection to cryptominning pool kustoUbiquiti - Unusual FTP connection to external server	20
`Description`	`contains`	`State: falsepos;` kustoGSA - TI Domain Entity kustoGSA - TI IP Entity kustoGSA - TI URL Entity kustoTI Map Domain Entity to DeviceNetworkEvents kustoTI Map Domain Entity to DeviceNetworkEvents kustoTI map Domain entity to SecurityAlert kustoTI map Domain entity to SecurityAlert kustoTI map File Hash to DeviceFileEvents Event kustoTI map File Hash to DeviceFileEvents Event kustoTI Map IP Entity to DeviceNetworkEvents kustoTI Map IP Entity to DeviceNetworkEvents kustoTI map IP entity to OfficeActivity kustoTI map IP entity to OfficeActivity kustoTI Map IP Entity to SigninLogs kustoTI Map IP Entity to SigninLogs kustoTI Map URL Entity to AuditLogs kustoTI Map URL Entity to AuditLogs kustoTI Map URL Entity to DeviceNetworkEvents kustoTI Map URL Entity to DeviceNetworkEvents kustoTI Map URL Entity to SecurityAlert Data kustoTI Map URL Entity to SecurityAlert Data	21
`Description`	`contains`	`State: inactive;` kustoGSA - TI Domain Entity kustoGSA - TI IP Entity kustoGSA - TI URL Entity kustoTI Map Domain Entity to DeviceNetworkEvents kustoTI Map Domain Entity to DeviceNetworkEvents kustoTI map Domain entity to SecurityAlert kustoTI map Domain entity to SecurityAlert kustoTI map File Hash to DeviceFileEvents Event kustoTI map File Hash to DeviceFileEvents Event kustoTI Map IP Entity to DeviceNetworkEvents kustoTI Map IP Entity to DeviceNetworkEvents kustoTI map IP entity to OfficeActivity kustoTI map IP entity to OfficeActivity kustoTI Map IP Entity to SigninLogs kustoTI Map IP Entity to SigninLogs kustoTI Map URL Entity to AuditLogs kustoTI Map URL Entity to AuditLogs kustoTI Map URL Entity to DeviceNetworkEvents kustoTI Map URL Entity to DeviceNetworkEvents kustoTI Map URL Entity to SecurityAlert Data kustoTI Map URL Entity to SecurityAlert Data	21

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Application Layer Protocol `T1071`

Events covered

Authoring guide

Fields filtered most (336 distinct)

Top indicator values (3000 distinct)

Exclusions (765 distinct)

Rules under this technique

Sigma 69 rules

Elastic 95 rules

Splunk 43 rules

Kusto 174 rules

YARA-L 2 rules

Panther 5 rules

Keyboard shortcuts

Search operators

Application Layer Protocol T1071

Events covered

Authoring guide

Fields filtered most (336 distinct)

Top indicator values (3000 distinct)

Exclusions (765 distinct)

Rules under this technique

Sigma 69 rules

Elastic 95 rules

Splunk 43 rules

Kusto 174 rules

YARA-L 2 rules

Panther 5 rules

Application Layer Protocol `T1071`