Elastic medium stable kql

Unusual Network Connection to Suspicious Top Level Domain

This rule monitors for the unusual occurrence of outbound network connections to suspicious top level domains.

View Source

Detection Logic

event.category : "network" and host.os.type : "macos" and event.type : "start" and
destination.domain : (*.team or *.lol or *.kr or *.ke or *.nu or *.space or 
                          *.capital or *.in or *.cfd or *.online or *.ru or 
                          *.info or *.top or *.buzz or *.xyz or *.rest or 
                          *.ml or *.cf or *.gq or *.ga or *.onion or 
                          *.network or *.monster or *.marketing or *.cyou or 
                          *.quest or *.cc or *.bar or *.click or *.cam or 
                          *.surf or *.tk or *.shop or *.club or *.icu or 
                          *.pw or *.ws or *.hair or *.mom or 
                          *.beauty or *.boats or *.fun or *.life or 
                          *.store)

Field Validations

Loading…

Comments (0)

Loading comments...