Elastic high stable kql

Halfbaked Command and Control Beacon

Halfbaked is a malware family used to establish persistence in a contested network. This rule detects a network activity algorithm leveraged by Halfbaked implant beacons for command and control.

View Source

Detection Logic

from packetbeat-*, filebeat-*, logs-network_traffic.* metadata _id, _version, _index
| where (
    data_stream.dataset in ("network_traffic.tls", "network_traffic.http") or
    (event.category in ("network", "network_traffic") and network.protocol == "http")
  )
| where network.transport == "tcp"
| where url.full RLIKE "http://[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}/cd"
| where destination.port in (53, 80, 8080, 443)
| keep @timestamp, url.full, source.ip, destination.ip, destination.port, network.protocol, data_stream.dataset, _id, _version, _index

False Positives

⚠ This rule should be tailored to exclude systems, either as sources or destinations, in which this behavior is expected.

Field Validations

Loading…

Comments (0)

Loading comments...