Detect beacon like pattern based on repetitive time intervals in Wire Data Traffic

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Query identifies beaconing patterns from Wire Data logs. Uses KQL functions to calculate time delta and find beaconing percentage. Results of beaconing to untrusted public networks can be investigated.

Attribute	Value
Type	Hunting Query
Solution	Standalone Content
ID	33aa0e01-87e2-43ea-87f9-2f7e3ff1d532
Tactics	CommandAndControl
Techniques	T1071, T1571
Required Connectors	AzureMonitor(WireData)
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
WireData	✓	✗	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries