Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Multiple distinct devices within the same tenant were blocked attempting to reach the same URL/domain within a 24-hour window. Isolated blocks are usually just one user's browsing; several independent devices converging on the same destination is a strong signal of a coordinated malware/C2 campaign spreading across the company (e.g. a phishing link opened by several employees, or malware propagating internally).
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Cybereinforce |
| ID | ec08477d-87a1-498d-8f34-72b8ec8f3758 |
| Severity | High |
| Kind | Scheduled |
| Tactics | CommandAndControl, LateralMovement |
| Techniques | T1071, T1570 |
| Required Connectors | cybereinforce_cte |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
CybereinforceCTE_CL |
? | ✓ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊