Skip to content
Threat Feed
Subscribe

Tag

Command_and_control

9 briefs RSS
medium threat

Unusual Child Process Execution from Linux Web Servers

This rule detects unusual child process executions originating from web server processes on Linux systems, which attackers may use to maintain persistence on a compromised system by exploiting web server vulnerabilities.

Jira +20 persistence execution command_and_control initial_access linux webserver
2r 4t
low advisory

Uncommon Destination Port Connection by Linux Web Server

This rule identifies unusual destination port network activity originating from a web server process on Linux systems, indicating potential web shell activity or unauthorized communication from a web server process to external systems by detecting egress connections from web server processes to non-standard ports while excluding common local IP ranges.

Elastic Defend persistence execution command_and_control web_shell linux
2r 4t
medium advisory

Suspicious Processes Connecting to Large Language Model Endpoints

This rule detects DNS queries to known Large Language Model (LLM) domains by unsigned binaries or common Windows scripting utilities, indicating potential command and control activity leveraging LLMs for dynamic actions on compromised systems.

command_and_control malware llm
3r 1t
low advisory

Kubectl Network Configuration Modification

This rule detects potential kubectl network configuration modification activity by monitoring for process events where the kubectl command is executed with arguments that suggest an attempt to modify network configurations in Kubernetes, potentially leading to unauthorized access or data exfiltration.

kubectl kubernetes command_and_control network_configuration linux macos
3r 2t
medium advisory

Node.js Spawning Curl or Wget for Command and Control

Detection of Node.js directly or via a shell spawning curl or wget, potentially indicating command and control behavior where adversaries download tools or payloads onto the system.

Node.js command_and_control nodejs curl wget initial_access
2r 2t
medium advisory

Malware Leveraging Large Language Model Endpoints for Command and Control

This rule detects DNS queries to known Large Language Model (LLM) domains originating from unsigned binaries or common Windows scripting utilities, indicating potential malware command and control activity.

Large Language Model services command_and_control llm malware windows macos
3r 1t 35i
high advisory

NetSupport Manager Execution from Unusual Path

This rule detects the execution of NetSupport remote access software from non-default paths, potentially indicating an adversary abusing NetSupport Manager for malicious remote control.

NetSupport Manager command_and_control remote_access_tool netsupport
2r 1t
high advisory

Kubernetes Pod Exec Potential Reverse Shell Activity Detected

This rule flags potential reverse shell activity via kubectl exec commands in Kubernetes pods by detecting specific shell and socket idioms within URL-decoded command payloads in Kubernetes audit logs, indicating post-exploitation interactive access and command-and-control.

Kubernetes reverse_shell execution command_and_control
3r 2t
medium advisory

Remote File Download via Script Interpreter

The rule identifies built-in Windows script interpreters, specifically cscript.exe or wscript.exe, being used to download an executable file from a remote destination, often employed by attackers for initial access or to deploy secondary payloads.

Windows command_and_control execution
2r 2t