Skip to content
Threat Feed
Subscribe

Tag

Network_traffic

2 briefs RSS
high threat

FIN7 DGA Command and Control Behavior Detection

This rule detects command and control activity associated with the FIN7 threat group, which is known to use domain generation algorithms (DGA) to maintain persistence in their target's network by identifying network traffic using TLS or HTTP protocols to domains with a specific pattern.

FIN7 +2 command-and-control dga network_traffic
3r 2t
high advisory

Detecting RPC Traffic from the Internet

This rule detects network events that may indicate the use of RPC traffic from the Internet, which is commonly targeted and exploited by threat actors as an initial access or backdoor vector.

network_traffic initial_access rpc
2r 1t