Palo Alto - potential beaconing detected

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


'Identifies beaconing patterns from Palo Alto Network traffic logs based on recurrent timedelta patterns. The query leverages various KQL functions to calculate time deltas and then compares it with total events observed in a day to find percentage of beaconing. This outbound beaconing pattern to untrusted public networks should be investigated for any malware callbacks or data exfiltration attempts. Reference Blog: http://www.austintaylor.io/detect/beaconing/intrusion/detection/system/command/c

Attribute Value
Type Analytic Rule
Solution Azure Cloud NGFW By Palo Alto Networks
ID f0be259a-34ac-4946-aa15-ca2b115d5feb
Severity Low
Status Available
Kind Scheduled
Tactics CommandAndControl
Techniques T1071, T1571
Required Connectors AzureCloudNGFWByPaloAltoNetworks
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
CommonSecurityLog ?
fluentbit_CL 🔶 ? ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Analytic Rules · Back to Azure Cloud NGFW By Palo Alto Networks