Analytics BIOC
Low
✕
A commonly abused process connected to a rare external host
A commonly abused process connected to a rare external host.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Command and Control (TA0011)
ATT&CK techniques: Application Layer Protocol: Web Protocols (T1071.001)
Detector tags: EDR Windows C2 Analytics
Attacker's goals:
Communicate with the attacker's Command and Control (C2) infrastructure.
Investigative actions:
Investigate the actor process connected to the external host. Get further details about the uncommon external destination. Assess whether this communication pattern is expected or not.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
3 variations:
- A commonly abused renamed process connected to a rare external host Medium (parent: Low)
- A commonly abused process connected to a globally rare external host Low
- A commonly abused rare process connected to a rare external host Low