Product
medium
advisory
Detection of Command and Control Activity via Commonly Abused Web Services
2 rules 2 TTPsThis rule detects command and control activity using common web services by identifying Windows hosts making DNS requests to a list of commonly abused web services from processes outside of known program locations, potentially indicating adversaries attempting to blend malicious traffic with legitimate network activity.
OneDrive +7
command-and-control
windows
threat-detection
2r
2t
medium
advisory
Masquerading Business Application Installers
2 rules 4 TTPsAttackers masquerade malicious executables as legitimate business application installers to trick users into downloading and executing malware, leveraging defense evasion and initial access techniques.
Elastic Defend +22
masquerading
defense-evasion
initial-access
malware
windows
2r
4t