BIOC Low

Out of band testing domain connection

Connection from web service process to out-of-band-testing domain.

Module:
Platform Analytics
Agent event type:
Network
Category:
Infiltration
Status:
Enabled
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Exploit Public-Facing Application (T1190)
Indicator:

Network action type = outgoing , failed , raw_packet AND remote host =~ burpcollabat\.net|canarytokens\.com|dnslog\.cn|interact\.sh|interactsh\.com|oast\.fun|oast\.live|oast\.me|oast\.online|oast\.pro|oast\.site|oastify\.com|ptst\.io|r87\.me|requestbin\.net Process initiated by = apache.exe , apache2.exe , caddy.exe , httpd.exe , jsvc.exe , lighthttpd.exe , lighttpd.exe , lshttpd.exe , nginx.exe , nhttpd.exe , node.exe , php-cgi.exe , php.exe , tomcat.exe , tomcat7.exe , w3wp.exe , cgo name = apache.exe , apache2.exe , caddy.exe , httpd.exe , jsvc.exe , lighthttpd.exe , lighttpd.exe , lshttpd.exe , nginx.exe , nhttpd.exe , node.exe , php-cgi.exe , php.exe , tomcat.exe , tomcat7.exe , w3wp.exe , os parent name = apache.exe , apache2.exe , caddy.exe , httpd.exe , jsvc.exe , lighthttpd.exe , lighttpd.exe , lshttpd.exe , nginx.exe , nhttpd.exe , node.exe , php-cgi.exe , php.exe , tomcat.exe , tomcat7.exe , w3wp.exe

Preventable: no