Cisco SE - Connection to known C2 server

Back


Id	0f788a93-dc88-4f80-89ef-bef7cd0fef05
Rulename	Cisco SE - Connection to known C2 server
Description	This rule is triggered when connection to known C2 is detected from host.
Severity	High
Tactics	CommandAndControl
Techniques	T1071
Required data connectors	CiscoSecureEndpoint
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco Secure Endpoint/Analytic Rules/CiscoSEC2Connection.yaml
Version	1.0.0
Arm template	0f788a93-dc88-4f80-89ef-bef7cd0fef05.json

KQL

CiscoSecureEndpoint
| where EventMessage has 'Suspected botnet connection'
| extend HostCustomEntity = DstHostname, MalwareCustomEntity = ThreatName

YAML

entityMappings:
- fieldMappings:
  - columnName: HostCustomEntity
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: MalwareCustomEntity
    identifier: Name
  entityType: Malware
triggerOperator: gt
tactics:
- CommandAndControl
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco Secure Endpoint/Analytic Rules/CiscoSEC2Connection.yaml
version: 1.0.0
query: |
  CiscoSecureEndpoint
  | where EventMessage has 'Suspected botnet connection'
  | extend HostCustomEntity = DstHostname, MalwareCustomEntity = ThreatName  
triggerThreshold: 0
relevantTechniques:
- T1071
queryPeriod: 15m
status: Available
severity: High
kind: Scheduled
name: Cisco SE - Connection to known C2 server
queryFrequency: 15m
id: 0f788a93-dc88-4f80-89ef-bef7cd0fef05
description: |
    'This rule is triggered when connection to known C2 is detected from host.'
requiredDataConnectors:
- dataTypes:
  - CiscoSecureEndpoint
  connectorId: CiscoSecureEndpoint

ARM