Elastic medium stable kql
Unusual Network Connection to Suspicious Top Level Domain
This rule monitors for the unusual occurrence of outbound network connections to suspicious top level domains.
Detection Logic
event.category : "network" and host.os.type : "macos" and event.type : "start" and
destination.domain : (*.team or *.lol or *.kr or *.ke or *.nu or *.space or
*.capital or *.in or *.cfd or *.online or *.ru or
*.info or *.top or *.buzz or *.xyz or *.rest or
*.ml or *.cf or *.gq or *.ga or *.onion or
*.network or *.monster or *.marketing or *.cyou or
*.quest or *.cc or *.bar or *.click or *.cam or
*.surf or *.tk or *.shop or *.club or *.icu or
*.pw or *.ws or *.hair or *.mom or
*.beauty or *.boats or *.fun or *.life or
*.store) Field Validations
Loading…
Comments (0)
Loading comments...