Detection rules › Splunk
Command and Control Detection (Sysmon)
Detects malicious (like Github repositories or known suspicious IPs) sources based on a list of IPs and domains
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 3: Network connection |
Rule body
id: '1043.1068'
title: Command and Control Detection
description: 'Detects malicious (like Github repositories or known suspicious IPs)
sources based on a list of IPs and domains. - Threat Actor Association: APT29/Nobelium/Cozy
Bear, Magic Hound (APT32, Phosphorus, Mint Sandstorm), UNC4990 - Software Association:
Alchimist, Remcos RAT'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=3 `fltr_bl_ip_address`
| table _time, host, user dest, dest_ip, dest_port, direction, dvc, dvc_nt_host,
event_id, eventtype, host, index, parent_process_id, process_id, process_name, process_path,
signature_id, source, sourcetype, src, src_ip, src_port, tag, transport, user, user_id|
bin span=60s | stats values(*) as * by _time, host `add_enrichment_rule("AVL_R1068")`
`hec_collect`'
techniques:
- command-and-control:application layer protocol:web protocols
- command-and-control:non-application layer protocol
technique_id:
- T1071.001
- T1095
data_category:
- Windows Sysmon
references: null