Analytics BIOC Informational
✕

A process connected to rare external host

A process connected to a rare external host.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Command and Control (TA0011)
ATT&CK techniques: Application Layer Protocol: Web Protocols (T1071.001)
Detector tags: EDR Windows C2 Analytics
Attacker's goals:

Communicate with the attacker's Command and Control (C2) infrastructure.

Investigative actions:

Get further details about the uncommon external destination and the actor process.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • A process connected to globally rare external host Informational