Analytics BIOC
Low
✕
Rare binary connected to a rare external host
Rare binary connected to a rare external host.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Command and Control (TA0011)
ATT&CK techniques: Application Layer Protocol: Web Protocols (T1071.001)
Detector tags: EDR Windows C2 Analytics
Attacker's goals:
Communicate with the attacker's Command and Control (C2) infrastructure.
Investigative actions:
Check the rare binary file. Get further details about the rare external destination.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
3 variations:
- Rare binary executing under an RMM CGO connected to a rare external host Low
- Rare unsigned binary connected to a globally rare external host Medium (parent: Low)
- Rare binary connected to a globally rare external host Low