Detect beacon like pattern based on repetitive time intervals in Wire Data Traffic

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Query identifies beaconing patterns from Wire Data logs. Uses KQL functions to calculate time delta and find beaconing percentage. Results of beaconing to untrusted public networks can be investigated.

Attribute	Value
Type	Hunting Query
Solution	Standalone Content
ID	33aa0e01-87e2-43ea-87f9-2f7e3ff1d532
Tactics	CommandAndControl
Techniques	T1071, T1571
Required Connectors	AzureMonitor(WireData)
Source	[View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Hunting Queries/WireData/WireDataBeacon.yaml)

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
WireData	RemotePortNumber != "0"	✓	✗	✗

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries