Analytics BIOC Informational
✕

Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol

A process made a connection to an external IP address or host that is rarely connected to by the organization.

Module:
Platform Analytics
Data source:
Palo Alto Networks Url Logs
ATT&CK tactics: Command and Control (TA0011)
ATT&CK techniques: Application Layer Protocol (T1071)
Attacker's goals:

Connect to a server to retrieve commands or exfiltrate data.

Investigative actions:

Check whether the process was injected or otherwise subverted for malicious use.

Test period:
N/A (single event)
Deduplication:
1 Day
4 variations:
  • Rare connection to external IP address or host by a java application using LDAP protocol Medium (parent: Informational)
  • Rare connection to external IP address or host by a java application using LDAP protocol Medium (parent: Informational)
  • Rare connection to external IP address or host by a java application using LDAP protocol Low (parent: Informational)
  • Rare connection to external IP address or host by a java application using RMI-IIOP protocol Low (parent: Informational)