Sigma medium test sigma

Suspicious C2 Activities

Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap. These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)

View Source

Detection Logic

{
  "selection": {
    "key": "susp_activity"
  },
  "condition": "selection"
}

False Positives

⚠ Admin or User activity

Field Validations

Loading…

Comments (0)

Loading comments...