Application Layer Protocol `T1071`

Tactic: Command & Control

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Events covered

47 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 3	Network connection
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Sysmon	Event ID 15	FileCreateStreamHash
Sysmon	Event ID 17	PipeEvent (Pipe Created)
Sysmon	Event ID 18	PipeEvent (Pipe Connected)
Sysmon	Event ID 22	DNSEvent (DNS query)
Sysmon	Event ID 23	FileDelete (File Delete archived)
Sysmon	Event ID 26	FileDeleteDetected (File Delete logged)
Security-Auditing	Event ID 4662	An operation was performed on an object.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4698	A scheduled task was created.
Security-Auditing	Event ID 5136	A directory service object was modified.
Security-Auditing	Event ID 5137	A directory service object was created.
Security-Auditing	Event ID 5152	The Windows Filtering Platform blocked a packet.
Security-Auditing	Event ID 5154	The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
Security-Auditing	Event ID 5155	The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
Security-Auditing	Event ID 5156	The Windows Filtering Platform has permitted a connection.
Security-Auditing	Event ID 5157	The Windows Filtering Platform has blocked a connection.
Security-Auditing	Event ID 5158	The Windows Filtering Platform has permitted a bind to a local port.
Security-Auditing	Event ID 5159	The Windows Filtering Platform has blocked a bind to a local port.
Defender-CloudAppEvents	any	Cloud app activity
Defender-DeviceEvents	any	Defender event
Defender-DeviceFileEvents	any	File activity
Defender-DeviceImageLoadEvents	any	Image load
Defender-DeviceNetworkEvents	any	Network activity
Defender-DeviceNetworkEvents	InboundConnectionAccepted	Inbound connection accepted
Defender-EmailEvents	any	Email processed
Defender-EmailUrlInfo	any	Email URL observed
Defender-UrlClickEvents	any	URL click activity
ESF	exec	Process Execution
ESF	write	File Write
AppLocker	Event ID 8002	FilePathBuffer was allowed to run.
AppLocker	Event ID 8003	RuleAndFileData.FilePath was allowed to run but would have been prevented from running if the AppLocker policy were enforced.
AppLocker	Event ID 8005	FilePathBuffer was allowed to run.
DNS-Client	Event ID 3008	DNS query is completed for the name QueryName, type QueryType, query options QueryOptions with status QueryStatus Results QueryResults.
DNSServer	Event ID 257	RESPONSE_SUCCESS: TCP=TCP; InterfaceIP=InterfaceIP; Destination=Destination; AA=AA; AD=AD; QNAME=QNAME; QTYPE=QTYPE; XID=XID; DNSSEC=DNSSEC; RCODE=RCODE; Port=Port; Flags=Flags; Scop...
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 800	Event ID 800
Service-Control-Manager	Event ID 7045	A service was installed in the system.
Sysmon-for-Linux	Event ID 1	Process Create

Authoring guide

These 514 rules share fields, values, and exclusions.

Fields filtered most (243 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	164	`eq` 144, `in` 31, `ne` 1	`exec`, `connection_attempted`, `start`, `connection_accepted`, `lookup_result`
`process_basename`	135	`in` 69, `eq` 60, `starts_with` 27, `wildcard` 25, `is_not_null` 6, `contains` 2, `ends_with` 2, `regex_match` 2	`bash`, `csh`, `busybox`, `dash`, `.*`
`event.type`	131	`eq` 131	`start`, `creation`, `end`, `change`, `connection`
`Image`	70	`wildcard` 26, `ends_with` 22, `starts_with` 21, `eq` 5, `contains` 4, `is_not_null` 2, `in` 1	`/dev/shm/`, `./`, `/boot/*`, `/bin/cat`, `/bin/chmod`
`process.args`	65	`eq` 32, `in` 23, `starts_with` 17, `wildcard` 17, `contains` 9, `regex_match` 5, `ends_with` 3	`-c`, `-cl`, `-i`, `-e`, `-lc`
`CommandLine`	64	`contains` 40, `wildcard` 23, `regex_match` 19, `ends_with` 3, `is_not_null` 2, `length_compare` 1, `like` 1, `match` 1	`* /dev/shm/`, ` /run/`, `/dev/shm/`, `/dev/tcp`, `/dev/udp/*`
`parent_process_basename`	50	`eq` 30, `in` 19, `starts_with` 13, `wildcard` 9, `ends_with` 2	`bash`, `csh`, `.cgi`, `.fcgi`, `.*`
`Active`	45	`eq` 45	`true`
`QueryName`	45	`ends_with` 12, `is_not_null` 12, `wildcard` 10, `contains` 9, `starts_with` 4, `eq` 2, `in` 2, `ne` 2, `regex_match` 2	, `.000webhostapp.com`, `.afraid.org`, `.aternos.me`, `.geojs.io`
`EventID`	29	`eq` 24, `in` 3, `regex_match` 2	`3`, `1`, `22`, `17`, `18`
`ParentImage`	29	`starts_with` 10, `wildcard` 9, `ends_with` 5, `is_not_null` 4, `contains` 1, `in` 1	`./`, `/boot/`, `/dev/shm/*`, , `/bin/java`
`process.args_count`	24	`eq` 9, `le` 9, `ge` 8	`3`, `1`, `2`, `4`, `5`
`SourceSystem`	21	`eq` 13, `starts_with` 8	`Lumen`, `GreyNoise`, `ThreatConnect-`, `HoneyLabs`
`c-useragent`	20	`starts_with` 9, `eq` 8, `contains` 5, `ne` 4, `ends_with` 3, `wildcard` 1	`null`, `Microsoft BITS/`, `(compatible;MSIE` , `Mozilla/`, `WindowsPowerShell/`
`ParentCommandLine`	17	`contains` 13, `wildcard` 3, `ends_with` 2, `regex_match` 2	`--port`, `/app/.js`, `/apps//.js`, `app.py`, `asgi.py*`

Top indicator values (4928 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticApple Script Execution followed by Network Connection elasticAt Utility Launched through Udevadm elasticBackground Task Execution via a Hidden Process elasticBind Shell via Netcat Traditional elasticBind Shell via Node elasticBind Shell via Socket elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticCurl or Wget Spawned via Node.js elasticCurl to Telegram API elasticDNS Request by Suspicious Process Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory +108 more rules	123	1036
`EventType`	`eq`	`exec` elasticAt Utility Launched through Udevadm elasticBackground Task Execution via a Hidden Process elasticBind Shell via Netcat Traditional elasticBind Shell via Node elasticBind Shell via Socket elasticCommand Interpreter with IP Address Argument elasticCurl to Telegram API elasticDNS Request by Suspicious Process Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child +74 more rules	89	547
`EventType`	`eq`	`connection_attempted` elasticCommand Interpreter with IP Address Argument elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell via setsid and nohup elasticLinux Reverse Shell via Suspicious Utility elasticLinux Reverse Shell via Xterm elasticNetcat Reverse Shell via Busybox +20 more rules	35	72
`EventType`	`eq`	`start` elasticConnection to Dynamic DNS Provider by a Signed Binary Proxy elasticConnection to Dynamic DNS Provider by an Unsigned Binary elasticConnection to WebService by a Signed Binary Proxy elasticConnection to WebService by an Unsigned Binary elasticDNS Over HTTPS by an Unusual Process elasticDNS Query to Suspicious Top Level Domain elasticJava Dropped and Executed With DNS Lookup elasticPossible JAVA Reverse Shell elasticPotential Command and Control via Windows Scripts elasticPotential Reverse Shell via Java elasticScripting or Unsigned Binary Performing DNS Lookups to Ethereum RPC Providers elasticSuspicious Command and Control via Internet Explorer elasticSuspicious Communication via Mail Protocol elasticSuspicious DNS Query from Mounted Virtual Disk elasticSuspicious Execution from a Windows Script +1 more rules	16	388
`Active`	`eq`	`true` kustoGreyNoise TI Map IP Entity to CommonSecurityLog kustoGreyNoise TI Map IP Entity to DnsEvents kustoGreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema) kustoGreyNoise TI map IP entity to OfficeActivity kustoGreyNoise TI Map IP Entity to SigninLogs kustoPreview - TI map Domain entity to Cloud App Events kustoPreview - TI map IP entity to Cloud App Events kustoPreview - TI map URL entity to Cloud App Events kustoThreat Connect TI map Domain entity to DnsEvents kustoThreatConnect TI map Email entity to OfficeActivity kustoThreatConnect TI map Email entity to SigninLogs kustoThreatConnect TI map IP entity to Network Session Events (ASIM Network Session schema) kustoThreatConnect TI Map URL Entity to OfficeActivity Data kustoTI map Domain entity to Dns Events (ASIM DNS Schema) kustoTI map Domain entity to DnsEvents +30 more rules	45	60
`process_basename`	`in`	`bash` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Hook Egress Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via setsid and nohup elasticLinux Suspicious Child Process Execution via Interactive Shell elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server +25 more rules	40	180
`process_basename`	`in`	`sh` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Hook Egress Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via setsid and nohup elasticLinux Suspicious Child Process Execution via Interactive Shell elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server +25 more rules	40	179
`process_basename`	`in`	`zsh` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Hook Egress Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via setsid and nohup elasticLinux Suspicious Child Process Execution via Interactive Shell elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server +25 more rules	40	179
`process_basename`	`in`	`dash` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Hook Egress Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via setsid and nohup elasticLinux Suspicious Child Process Execution via Interactive Shell elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server +23 more rules	38	149
`process_basename`	`in`	`csh` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Hook Egress Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via setsid and nohup elasticLinux Suspicious Child Process Execution via Interactive Shell elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server +22 more rules	37	147
`process_basename`	`in`	`fish` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Hook Egress Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via setsid and nohup elasticLinux Suspicious Child Process Execution via Interactive Shell elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server +22 more rules	37	150
`process_basename`	`in`	`ksh` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Hook Egress Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via setsid and nohup elasticLinux Suspicious Child Process Execution via Interactive Shell elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server +22 more rules	37	148
`process_basename`	`in`	`tcsh` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGit Hook Egress Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via setsid and nohup elasticLinux Suspicious Child Process Execution via Interactive Shell elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server +22 more rules	37	144
`process_basename`	`in`	`curl` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticCurl to Telegram API elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticFile Downloaded by Curl/Wget and Piped to Interpreter elasticGit Repository or File Download to Suspicious Directory elasticLinux Telegram API Request elasticPayload Execution via Shell Pipe Detected by Defend for Containers elasticPotential Remote Code Execution via Database Server elasticPotential Remote Code Execution via Mail Server +8 more rules	23	81
`process_basename`	`in`	`wget` elasticCommand Interpreter with IP Address Argument elasticCurl or Wget Spawned via Node.js elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticFile Downloaded by Curl/Wget and Piped to Interpreter elasticGit Repository or File Download to Suspicious Directory elasticLinux Telegram API Request elasticPayload Execution via Shell Pipe Detected by Defend for Containers elasticPotential Remote Code Execution via Database Server elasticPotential Remote Code Execution via Mail Server elasticRecently Downloaded File Made Executable and Run +5 more rules	20	40
`process_basename`	`in`	`busybox` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticPayload Downloaded via Curl or Wget by Web Server elasticPayload Execution by Node.js Web Server elasticPayload Execution by Web Server elasticPotential Remote Code Execution via Database Server elasticPotential Remote Code Execution via Mail Server elasticPotential Reverse Shell Activity via TCP/UDP Socket elasticScript DNS Query to Managed Kubernetes Cluster elasticSuspicious Echo Execution elasticUnusual Command Execution via Cron +2 more rules	17	66
`EventType`	`in`	`connection_attempted` elasticHidden Process Execution followed by Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via netcat elasticPANW and Elastic Defend - Command and Control Correlation elasticPossible JAVA Reverse Shell elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Java elasticPotential Reverse Shell via Java elasticPotential Reverse Shell via Suspicious Binary elasticPotential Reverse Shell via Suspicious Child Process elasticSuricata and Elastic Defend Network Correlation elasticSuspicious PHP Script Execution	14	24
`EventType`	`in`	`exec` elasticConnection to External Network via Telnet elasticCurl or Wget Spawned via Node.js elasticLinux Reverse Shell elasticLinux Telegram API Request elasticOpenssl Client or Server Activity elasticPayload Execution via Shell Pipe Detected by Defend for Containers elasticPotential Linux Tunneling and/or Port Forwarding elasticPotential Reverse Shell elasticPotential Reverse Shell via Background Process elasticPotential Reverse Shell via Suspicious Child Process elasticSimple HTTP Web Server Creation elasticSuspicious Command Execution via Busybox Proxy	12	180
`EventType`	`in`	`connection_accepted` elasticHidden Process Execution followed by Network Connection elasticLinux Reverse Shell elasticLinux Reverse Shell via Child elasticLinux Reverse Shell via netcat elasticPossible JAVA Reverse Shell elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Java elasticPotential Reverse Shell via Java elasticPotential Reverse Shell via Suspicious Binary elasticPotential Reverse Shell via Suspicious Child Process	11	14
`process.args`	`eq`	`-c` elasticCommand Interpreter with IP Address Argument elasticEgress Network Connection from Node.js Descendant elasticLinux Reverse Shell via Suspicious Utility elasticPotential Python Reverse Shell elasticPotential Remote Code Execution via Database Server elasticPotential Remote Code Execution via Langflow elasticPotential Remote Code Execution via Mail Server elasticPython Network Connection Followed by Command Execution elasticReverse or Bind Shell via Suspicious Utility elasticShell Execution via Java Parent Process elasticSuspicious Installer Package Spawns Network Event elasticSuspicious Interpreter Execution Detected via Defend for Containers elasticSuspicious Shell Command Execution via Node.js Parent elasticSuspicious Shell Execution via Java Application	14	91
`process_basename`	`wildcard`	`python*` elasticDNS Request by Recently Created Executable elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticEgress Network Connection from Node.js Descendant elasticFile Downloaded by Curl/Wget and Piped to Interpreter elasticLinux Reverse Shell via setsid and nohup elasticLinux Reverse Shell via Suspicious Utility elasticPayload Downloaded and Piped to Interpreter elasticPayload Downloaded by Interpreter and Piped to Interpreter elasticPayload Execution via Shell Pipe Detected by Defend for Containers elasticPotential Remote Code Execution via URL Encoded Payload elasticSuspicious File Downloaded by Curl/Wget and Piped to Interpreter elasticSuspicious Network Connection via Installer Package	14	32
`process_basename`	`wildcard`	`lua*` elasticDNS Request by Recently Created Executable elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticEgress Network Connection from Node.js Descendant elasticFile Downloaded by Curl/Wget and Piped to Interpreter elasticLinux Reverse Shell via setsid and nohup elasticLinux Reverse Shell via Suspicious Utility elasticPayload Downloaded and Piped to Interpreter elasticPayload Downloaded by Interpreter and Piped to Interpreter elasticPayload Execution via Shell Pipe Detected by Defend for Containers elasticPotential Remote Code Execution via URL Encoded Payload elasticSuspicious File Downloaded by Curl/Wget and Piped to Interpreter	13	29
`process_basename`	`wildcard`	`php*` elasticDNS Request by Recently Created Executable elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticEgress Network Connection from Node.js Descendant elasticFile Downloaded by Curl/Wget and Piped to Interpreter elasticLinux Reverse Shell via setsid and nohup elasticLinux Reverse Shell via Suspicious Utility elasticPayload Downloaded and Piped to Interpreter elasticPayload Downloaded by Interpreter and Piped to Interpreter elasticPayload Execution via Shell Pipe Detected by Defend for Containers elasticPotential Remote Code Execution via URL Encoded Payload elasticSuspicious File Downloaded by Curl/Wget and Piped to Interpreter	13	28
`process_basename`	`wildcard`	`ruby*` elasticDNS Request by Recently Created Executable elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticEgress Network Connection from Node.js Descendant elasticFile Downloaded by Curl/Wget and Piped to Interpreter elasticLinux Reverse Shell via setsid and nohup elasticPayload Downloaded and Piped to Interpreter elasticPayload Downloaded by Interpreter and Piped to Interpreter elasticPayload Execution via Shell Pipe Detected by Defend for Containers elasticPotential Remote Code Execution via URL Encoded Payload elasticSuspicious File Downloaded by Curl/Wget and Piped to Interpreter	12	27
`process_basename`	`wildcard`	`perl*` elasticDNS Request by Recently Created Executable elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticEgress Network Connection from Node.js Descendant elasticFile Downloaded by Curl/Wget and Piped to Interpreter elasticPayload Downloaded and Piped to Interpreter elasticPayload Downloaded by Interpreter and Piped to Interpreter elasticPayload Execution via Shell Pipe Detected by Defend for Containers elasticPotential Remote Code Execution via URL Encoded Payload elasticSuspicious File Downloaded by Curl/Wget and Piped to Interpreter	11	25
`Image`	`starts_with`	`/dev/shm/*` elasticDNS Request by Suspicious Process Executable elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Node.js Descendant elasticNetwork Connection Followed by File Creation elasticOutbound Network Connection Followed by Process File Deletion elasticPotential Remote Code Execution via Database Server elasticPotential Remote Code Execution via Mail Server elasticPotential Remote Code Execution via URL Encoded Payload elasticPotential Reverse Shell Activity via TCP/UDP Socket elasticSuspicious Process Execution Detected via Defend for Containers elasticSuspicious Web Server Child Process elasticSystem Path File Creation and Execution Detected via Defend for Containers	12	38
`Image`	`starts_with`	`/var/tmp/*` elasticDNS Request by Suspicious Process Executable elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Node.js Descendant elasticNetwork Connection Followed by File Creation elasticOutbound Network Connection Followed by Process File Deletion elasticPotential Remote Code Execution via Database Server elasticPotential Remote Code Execution via Mail Server elasticPotential Remote Code Execution via URL Encoded Payload elasticPotential Reverse Shell Activity via TCP/UDP Socket elasticSuspicious Process Execution Detected via Defend for Containers elasticSuspicious Web Server Child Process elasticSystem Path File Creation and Execution Detected via Defend for Containers	12	40
`Image`	`starts_with`	`/tmp/*` elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Node.js Descendant elasticNetwork Connection Followed by File Creation elasticOutbound Network Connection Followed by Process File Deletion elasticPotential Remote Code Execution via Database Server elasticPotential Remote Code Execution via Mail Server elasticPotential Remote Code Execution via URL Encoded Payload elasticPotential Reverse Shell Activity via TCP/UDP Socket elasticSuspicious Process Execution Detected via Defend for Containers elasticSuspicious Web Server Child Process elasticSystem Path File Creation and Execution Detected via Defend for Containers	11	40
`QueryName`	`is_not_null`	elasticConnection to Commonly Abused Web Services elasticDNS Request to Suspicious Top Level Domain elasticDNS to Commonly Abused Web Services elasticGenAI Process Connection to Suspicious Top Level Domain elasticNetwork Activity to a Suspicious Top Level Domain elasticPotential DNS Tunneling via Long and Unique Subdomains elasticSuspicious PHP Script Execution elasticSuspicious Terraform Provider Execution and Network Connection elasticSystem Public IP Discovery via DNS Query elasticUncommon DNS Request via Bun or Node.js kustoKnown Forest Blizzard group domains - July 2019 kustoMercury - Domain, Hash and IP IOCs - August 2022	12	19
`IsActive`	`eq`	`true` kustoHoneyLabs TI Map IP Entity to CommonSecurityLog kustoHoneyLabs TI Map IP Entity to Network Session (ASIM) kustoHoneyLabs TI Map URL Entity to CommonSecurityLog kustoLumen TI domain in DnsEvents kustoLumen TI IPAddress in CommonSecurityLog kustoLumen TI IPAddress in DeviceEvents kustoLumen TI IPAddress in IdentityLogonEvents kustoLumen TI IPAddress in OfficeActivity kustoLumen TI IPAddress in SecurityEvents kustoLumen TI IPAddress in SigninLogs kustoLumen TI IPAddress in WindowsEvents	11	12

Exclusions (2462 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`dest_ip`	`cidr_match`	`127.0.0.0/8` sigmaOutbound Network Connection Initiated By Microsoft Dialer elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell +39 more rules	54
`dest_ip`	`cidr_match`	`169.254.0.0/16` sigmaOutbound Network Connection Initiated By Microsoft Dialer elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell +39 more rules	54
`dest_ip`	`cidr_match`	`10.0.0.0/8` sigmaOutbound Network Connection Initiated By Microsoft Dialer elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell +32 more rules	47
`dest_ip`	`cidr_match`	`172.16.0.0/12` sigmaOutbound Network Connection Initiated By Microsoft Dialer elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell +32 more rules	47
`dest_ip`	`cidr_match`	`224.0.0.0/4` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via Child +32 more rules	47
`dest_ip`	`cidr_match`	`::1` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via Child +32 more rules	47
`dest_ip`	`cidr_match`	`192.168.0.0/16` sigmaOutbound Network Connection Initiated By Microsoft Dialer elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell +31 more rules	46
`dest_ip`	`cidr_match`	`192.0.0.0/24` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via netcat +25 more rules	40
`dest_ip`	`cidr_match`	`192.0.2.0/24` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via netcat +25 more rules	40
`dest_ip`	`cidr_match`	`192.88.99.0/24` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via netcat +25 more rules	40
`dest_ip`	`cidr_match`	`240.0.0.0/4` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via netcat +25 more rules	40
`dest_ip`	`cidr_match`	`100.64.0.0/10` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via netcat +24 more rules	39
`dest_ip`	`cidr_match`	`192.175.48.0/24` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via netcat +24 more rules	39
`dest_ip`	`cidr_match`	`192.31.196.0/24` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via netcat +24 more rules	39
`dest_ip`	`cidr_match`	`192.52.193.0/24` elasticApple Script Execution followed by Network Connection elasticCommand Interpreter with IP Address Argument elasticConnection to External Network via Telnet elasticEgress Connection from Entrypoint in Container elasticEgress Network Connection by MOTD Child elasticEgress Network Connection Followed by Command Execution elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from Deleted Executable by Root elasticEgress Network Connection from Node.js Descendant elasticEgress Network Connection from RPM Package elasticGit Hook Egress Network Connection elasticHigh Number of Egress Network Connections from Unusual Executable elasticJavascript Reverse Shell via Node.js elasticLinux Reverse Shell elasticLinux Reverse Shell via netcat +24 more rules	39

Application Layer Protocol `T1071`

Events covered

Authoring guide

Fields filtered most (243 distinct)

Top indicator values (4928 distinct)

Exclusions (2462 distinct)

Rules under this technique

Sigma 70 rules

Elastic 198 rules

Splunk 47 rules

Kusto 192 rules

YARA-L 2 rules

Panther 5 rules

Application Layer Protocol T1071

Events covered

Authoring guide

Fields filtered most (243 distinct)

Top indicator values (4928 distinct)

Exclusions (2462 distinct)

Rules under this technique

Sigma 70 rules

Elastic 198 rules

Splunk 47 rules

Kusto 192 rules

YARA-L 2 rules

Panther 5 rules

Application Layer Protocol `T1071`