Skip to content
Threat Feed

Tag

Network-Traffic

4 briefs RSS
low advisory

Potential Data Exfiltration to Unusual Geographic Region via Machine Learning

A machine learning job has detected potential data exfiltration activity to an unusual geographical region, specifically by region name, indicating exfiltration over command and control channels.

data-exfiltration machine-learning network-traffic
2r 1t
high advisory

Detecting RPC Traffic to the Internet

This brief focuses on detecting Remote Procedure Call (RPC) traffic originating from internal networks and reaching the public internet, which is indicative of potential initial access or backdoor activity.

Elastic License v2 network-traffic initial-access lateral-movement rpc
2r 2t
low threat

Suspicious SMTP Activity on Port 26/TCP

This rule detects SMTP traffic on TCP port 26, an alternative to the standard port 25 that the BadPatch malware family has used for command and control of Windows systems.

BadPatch command-and-control exfiltration network-traffic
2r 3t
medium advisory

Large ICMP Traffic Detection

This analytic identifies excessive ICMP traffic to external IP addresses exceeding 1,000 bytes, potentially indicating command and control activity, data exfiltration, or covert communication channels.

Splunk Enterprise +4 network-traffic command-and-control data-exfiltration
2r 1t