Correlation of Palo Alto Networks C2 Alerts with Endpoint Process Activity

This detection rule provides an integrated approach to identifying Command and Control (C2) activity by correlating network security logs from Palo Alto Networks (PANW) firewalls with host-level network telemetry from Elastic Defend. By matching network flows based on source IP, source port, and destination IP within a one-minute window, security teams can attribute network-level alerts to specific processes running on endpoints. This is critical for security operations as it bridges the gap between opaque perimeter firewall alerts and the actionable endpoint context required for incident response. The detection works across Windows, Linux, and macOS environments, enabling defenders to identify the parent process, command-line arguments, and historical behavior of binaries engaged in suspicious outbound communication.

Impact

Successful exploitation or persistence by threat actors often involves C2 communication. If this activity is not attributed to a specific process, defenders may be unable to identify the source of the infection or perform effective remediation. This correlation method minimizes response time by providing the necessary process-level details to terminate malicious activity and isolate compromised systems, thereby reducing the risk of unauthorized data exfiltration or lateral movement.

Recommendation

• Deploy the correlation logic to your SIEM to monitor for network flows identified as C2 by PANW that coincide with endpoint connection attempts.
• Prioritize investigation of processes identified by the correlation, focusing on command-line parameters and process reputation.
• Implement blocking rules on your firewall for the destination IPs flagged as C2 in these correlation events.
• Use the endpoint telemetry to review all network connections performed by the identified process within the 48 hours prior to the detection.