Techniques
Sample rules
Halfbaked Command and Control Beacon
- source: elastic
- technicques:
- T1071
- T1568
Description
Halfbaked is a malware family used to establish persistence in a contested network. This rule detects a network activity algorithm leveraged by Halfbaked implant beacons for command and control.
Detection logic
from packetbeat-*, filebeat-*, logs-network_traffic.* metadata _id, _version, _index
| where (
data_stream.dataset in ("network_traffic.tls", "network_traffic.http") or
(event.category in ("network", "network_traffic") and network.protocol == "http")
)
| where network.transport == "tcp"
| where url.full RLIKE "http://[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}/cd"
| where destination.port in (53, 80, 8080, 443)
| keep @timestamp, url.full, source.ip, destination.ip, destination.port, network.protocol, data_stream.dataset, _id, _version, _index