Webservice

This rule detects command and control communications using common web services to blend in with legitimate traffic by identifying network connections from Windows hosts to domains and services abused for C2, while excluding known legitimate program locations.

This rule detects command and control (C2) communications that use common web services to hide malicious activity on Windows hosts by identifying network connections to commonly abused web services from processes outside of known legitimate program locations, indicating potential exfiltration or C2 activity blended with legitimate traffic.

This rule detects command and control communications using common web services to blend malicious traffic with legitimate network activity, identifying processes outside known program locations communicating with services like pastebin, google docs, dropbox, onedrive, ngrok, discord, and telegram which are often abused for exfiltration or command and control.