MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control |
Rule body
id: 05850746-9ae4-412f-838b-844f0903f4a9
name: Corelight - External Proxy Detected
description: |
'Detects external proxy usage.'
severity: Low
status: Available
requiredDataConnectors:
- connectorId: Corelight
dataTypes:
- Corelight_v2_http
- corelight_http
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- DefenseEvasion
- CommandAndControl
relevantTechniques:
- T1090
query: |
corelight_http
| where isnotempty(proxied)
| where not(ipv4_is_private(id_orig_h))
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: id_orig_h
version: 2.1.0
kind: Scheduled
Stages and Predicates
Stage 1: source
corelight_http
Stage 2: where
| where isnotempty(proxied)
Stage 3: where
| where not(ipv4_is_private(id_orig_h))
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
id_orig_h | cidr_match | 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 127.0.0.0/8 | excludes:id_orig_h |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
proxied | is_not_null | field:"proxied" kind:is_not_null |