Command & Control
Threat Intelligence Match
Detection overview
Triggers
- An internal host is connecting to an external system and the connection has met criteria specified in one or more configured threat feeds
Possible Root Causes
- A host includes malware which is initiating the connection that triggered the detection • A user on the host manually initiated the connection which triggered the detection
Business Impact
- Presence of command & control is a property of most attacks that originate from the outside
- The threat intel feed may have included additional context tied to the specific criteria that the connection met
- Business risk associated with outside control of an internal host is very high
Steps to Verify
- Refer to the information accompanying your threat feed as it may include verification and remediation instructions
- Determine which process on the internal host is sending the traffic which was flagged; in Windows systems, this can be done using a combination of netstat and tasklist commands
- Check if a user has knowingly installed remote access software and decide whether the resulting risk is acceptable
- Scan the computer for known malware and potentially reimage it, noting that some infections leave no trace on disk and reside entirely in memory
Threat Intelligence Match
Possible root causes
Malicious Detection
Benign Detection
Threat Intelligence Match
Example scenarios
Threat Intelligence Match
Business impact
If this detection indicates a genuine threat, the organization faces significant risks:
Threat Intelligence Match
Steps to investigate
Threat Intelligence Match
MITRE ATT&CK techniques covered
No items found.
Threat Intelligence Match
Related detections
No items found.