Analytics BIOC Informational
✕

Uncommon Linux process communication to a rare external host

An uncommon process is connecting to an external domain that is rarely accessed within the organization. This connection pattern is consistent with malware initiating connection to its command and control server.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Command and Control (TA0011)
ATT&CK techniques: Application Layer Protocol (T1071)
Detector tags: Abnormal Communication Analytics
Attacker's goals:

Communicate with malware running on your network to control malware activities, perform software updates on the malware, or to take inventory of infected machines.

Investigative actions:

Identify the process contacting the remote domain and determine whether the traffic is malicious. Look for other endpoints on your network that are alsocontacting the suspicious domain. Inspect the domain or URL for suspicious indicators or its presence in malicious reputation lists.

Test period:
N/A (single event)
Deduplication:
1 Day
6 variations:
  • Uncommon Linux process communication to a rare external host by an automated penetration testing tool Medium (parent: Informational)
  • Uncommon Linux process communication to a rare external host involving a code sharing website Low (parent: Informational) Adds Web Service (T1102)
  • Uncommon Linux process communication to a rare external host involving a low-prevalence process connecting to a rare Top-Level Domain Low (parent: Informational)
  • Uncommon Linux process communication to a rare external host with an external IP in the command line Low (parent: Informational)
  • Uncommon Linux process communication to a rare external host using a data transfer tool Low (parent: Informational) Adds Exfiltration Over C2 Channel (T1041)
  • Uncommon Linux process communication to a rare external host identified as global anomaly Low (parent: Informational)